From: Devansh Patel <[email protected]> The default product-only mapping also matches the unrelated Tanium Patch product. gnu:patch is the active NVD dictionary CPE and configuration identity, and is also used by CNA affected data for the packaged GNU source.
This retains all 15 GNU patch records, including the two current-version CVEs already fixed by recipe patches, while removing three Tanium false positives. Signed-off-by: Devansh Patel <[email protected]> --- meta/recipes-devtools/patch/patch_2.8.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/patch/patch_2.8.bb b/meta/recipes-devtools/patch/patch_2.8.bb index 6317ac775d..33142ac574 100644 --- a/meta/recipes-devtools/patch/patch_2.8.bb +++ b/meta/recipes-devtools/patch/patch_2.8.bb @@ -1,6 +1,8 @@ require patch.inc LICENSE = "GPL-3.0-only" +CVE_PRODUCT = "gnu:patch" + SRC_URI[sha256sum] = "308a4983ff324521b9b21310bfc2398ca861798f02307c79eb99bb0e0d2bf980" LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244323): https://lists.openembedded.org/g/openembedded-core/message/244323 Mute This Topic: https://lists.openembedded.org/mt/120933744/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
