[OE-core][PATCH] avahi: correct CVE_PRODUCT mapping

[OE-core][PATCH] avahi: correct CVE_PRODUCT mapping

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

The current "avahi" mapping generates a vendor-wildcard product identity
for the packaged Avahi source.

Use "avahi:avahi", which matches the active NVD dictionary CPE, NVD
configuration criteria, and CNA affected data for the upstream project.

This changes the generated identity from
cpe:2.3:*:*:avahi:0.9~rc5:*:*:*:*:*:*:* to
cpe:2.3:*:avahi:avahi:0.9~rc5:*:*:*:*:*:*:*, but sbom-cve-check 1.3.3
with the frozen 2026-08-10 databases has no current CVE report delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-connectivity/avahi/avahi_0.9.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-connectivity/avahi/avahi_0.9.bb b/meta/recipes-connectivity/avahi/avahi_0.9.bb
index 7cf0eb2b71..9397baa6ab 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.9.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.9.bb
@@ -29,6 +29,8 @@ SRC_URI = "git://github.com/avahi/avahi;protocol=https;branch=master;tag=v0.9-rc
 PV = "0.9~rc5"
 SRCREV = "71b640e686964efb27cb708f4457ffaed183c319"
 
+CVE_PRODUCT = "avahi:avahi"
+
 GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/"
 
 CVE_STATUS[CVE-2021-26720] = "not-applicable-platform: Issue only affects Debian/SUSE"
-- 
2.35.6

Re: [OE-core][PATCH] avahi: correct CVE_PRODUCT mapping

[Paul Barker]

On Mon, 2026-08-24 at 04:01 -0700, Devansh Patel -X (devanshp - E
INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> From: Devansh Patel <devanshp@cisco.com>
> 
> The current "avahi" mapping generates a vendor-wildcard product identity
> for the packaged Avahi source.
> 
> Use "avahi:avahi", which matches the active NVD dictionary CPE, NVD
> configuration criteria, and CNA affected data for the upstream project.
> 
> This changes the generated identity from
> cpe:2.3:*:*:avahi:0.9~rc5:*:*:*:*:*:*:* to
> cpe:2.3:*:avahi:avahi:0.9~rc5:*:*:*:*:*:*:*, but sbom-cve-check 1.3.3
> with the frozen 2026-08-10 databases has no current CVE report delta.
> 
> Signed-off-by: Devansh Patel <devanshp@cisco.com>
> ---
>  meta/recipes-connectivity/avahi/avahi_0.9.bb | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/meta/recipes-connectivity/avahi/avahi_0.9.bb b/meta/recipes-connectivity/avahi/avahi_0.9.bb
> index 7cf0eb2b71..9397baa6ab 100644
> --- a/meta/recipes-connectivity/avahi/avahi_0.9.bb
> +++ b/meta/recipes-connectivity/avahi/avahi_0.9.bb
> @@ -29,6 +29,8 @@ SRC_URI = "git://github.com/avahi/avahi;protocol=https;branch=master;tag=v0.9-rc
>  PV = "0.9~rc5"
>  SRCREV = "71b640e686964efb27cb708f4457ffaed183c319"
>  
> +CVE_PRODUCT = "avahi:avahi"

Hi,

I have the same feedback as I sent for the binutils patch [1].

What is the motivation for this CVE_PRODUCT assignment?

[1]: https://lore.kernel.org/openembedded-core/82653ab103f8116bfb0a9a675cf9d7f38a92a588.camel@pbarker.dev/

Best regards,

-- 
Paul Barker