On Mon, 2026-08-24 at 04:01 -0700, Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > From: Devansh Patel <[email protected]> > > The current "avahi" mapping generates a vendor-wildcard product identity > for the packaged Avahi source. > > Use "avahi:avahi", which matches the active NVD dictionary CPE, NVD > configuration criteria, and CNA affected data for the upstream project. > > This changes the generated identity from > cpe:2.3:*:*:avahi:0.9~rc5:*:*:*:*:*:*:* to > cpe:2.3:*:avahi:avahi:0.9~rc5:*:*:*:*:*:*:*, but sbom-cve-check 1.3.3 > with the frozen 2026-08-10 databases has no current CVE report delta. > > Signed-off-by: Devansh Patel <[email protected]> > --- > meta/recipes-connectivity/avahi/avahi_0.9.bb | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/meta/recipes-connectivity/avahi/avahi_0.9.bb > b/meta/recipes-connectivity/avahi/avahi_0.9.bb > index 7cf0eb2b71..9397baa6ab 100644 > --- a/meta/recipes-connectivity/avahi/avahi_0.9.bb > +++ b/meta/recipes-connectivity/avahi/avahi_0.9.bb > @@ -29,6 +29,8 @@ SRC_URI = > "git://github.com/avahi/avahi;protocol=https;branch=master;tag=v0.9-rc > PV = "0.9~rc5" > SRCREV = "71b640e686964efb27cb708f4457ffaed183c319" > > +CVE_PRODUCT = "avahi:avahi"
Hi, I have the same feedback as I sent for the binutils patch [1]. What is the motivation for this CVE_PRODUCT assignment? [1]: https://lore.kernel.org/openembedded-core/[email protected]/ Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244389): https://lists.openembedded.org/g/openembedded-core/message/244389 Mute This Topic: https://lists.openembedded.org/mt/120901045/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
