* [meta-python][PATCH] python3-pymongo: correct CVE_PRODUCT mapping
@ 2026-08-21 12:59 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 0 replies; only message in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-08-21 12:59 UTC (permalink / raw)
To: openembedded-devel; +Cc: xe-linux-external
From: Devansh Patel <devanshp@cisco.com>
The product-only "pymongo" value emits a wildcard-vendor identity and
omits the second authoritative name for the packaged MongoDB Python
driver.
Use "mongodb:python_driver" for its NVD dictionary CPE family and
"mongodb:pymongo" for its NVD dictionary CPE and configuration identity.
With sbom-cve-check 1.3.3 and the pinned database snapshots, the
generated product identity changes; the current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb b/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb
index 663de17352..4255650834 100644
--- a/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"
SRC_URI[sha256sum] = "70ffa08ba641468cc068cf46c06b34f01a8ce3489f6411309fcb5ceabe6b2fc0"
-CVE_PRODUCT = "pymongo"
+CVE_PRODUCT = "mongodb:python_driver mongodb:pymongo"
inherit pypi python_hatchling
--
2.35.6
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-21 12:59 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-21 12:59 [meta-python][PATCH] python3-pymongo: correct CVE_PRODUCT mapping Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.