On Mon, 2026-08-24 at 04:01 -0700, Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > From: Devansh Patel <[email protected]> > > The current product-only mapping generates vendor-wildcard CPEs, while > the old libexpat:expat dictionary entries are deprecated. > libexpat_project:libexpat is the active NVD dictionary CPE and > configuration identity, and is also used by CNA affected-data records > for the packaged libexpat source. > > This changes the generated product identity. With the frozen > sbom-cve-check database, the 63-entry CVE report is unchanged, so this is > an identity correction with no CVE delta. > > Signed-off-by: Devansh Patel <[email protected]> > --- > meta/recipes-core/expat/expat_2.8.3.bb | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/meta/recipes-core/expat/expat_2.8.3.bb > b/meta/recipes-core/expat/expat_2.8.3.bb > index 79e8c15227..e431792826 100644 > --- a/meta/recipes-core/expat/expat_2.8.3.bb > +++ b/meta/recipes-core/expat/expat_2.8.3.bb > @@ -30,4 +30,4 @@ do_install_ptest:class-target() { > > BBCLASSEXTEND += "native nativesdk" > > -CVE_PRODUCT = "expat libexpat" > +CVE_PRODUCT = "libexpat_project:libexpat"
Hi, This change would exclude CVEs that actually do apply to expat, such as CVE-2026-76641 which has CPE libexpat:libexpat in the MITRE database (most easily seen in the json representation [1]). I don't think it is correct. What was the motivation to change this CVE_PRODUCT assignment? [1]: https://cveawg.mitre.org/api/cve/CVE-2026-76641 Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244388): https://lists.openembedded.org/g/openembedded-core/message/244388 Mute This Topic: https://lists.openembedded.org/mt/120901048/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
