* [PATCH] python3-lxml: correct CVE_PRODUCT mapping
@ 2026-08-21 12:59 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 0 replies; only message in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-08-21 12:59 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
The current product-only "lxml" mapping generates a wildcard-vendor
product identity instead of the vendor assigned to the packaged project.
Use "lxml:lxml" for its exact NVD dictionary CPE, NVD configuration,
and CNA affected-data identity. This changes the generated CPE, but the
current CVE report is unchanged with sbom-cve-check 1.3.3 and the pinned
NVD snapshot.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
meta/recipes-devtools/python/python3-lxml_6.1.1.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/python/python3-lxml_6.1.1.bb b/meta/recipes-devtools/python/python3-lxml_6.1.1.bb
index 4ca7f08b39..da19905f89 100644
--- a/meta/recipes-devtools/python/python3-lxml_6.1.1.bb
+++ b/meta/recipes-devtools/python/python3-lxml_6.1.1.bb
@@ -39,6 +39,6 @@ BBCLASSEXTEND = "native nativesdk"
RDEPENDS:${PN} += "libxml2 libxslt python3-compression"
-CVE_PRODUCT = "lxml"
+CVE_PRODUCT = "lxml:lxml"
CLEANBROKEN = "1"
--
2.35.6
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-21 12:59 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-21 12:59 [PATCH] python3-lxml: correct CVE_PRODUCT mapping Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.