[OE-core][PATCH] openssh: correct CVE_PRODUCT mapping

[OE-core][PATCH] openssh: correct CVE_PRODUCT mapping

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

The default product-only mapping generates a vendor-wildcard CPE. NVD
deprecates each openssh:openssh record in favor of openbsd:openssh, the
active dictionary CPE and configuration identity for the packaged source.
The deprecated spelling has no exclusive CVEs in the frozen backend.

This changes the generated product identity to the active exact CPE, but
the frozen sbom-cve-check database leaves the 137-entry CVE report
unchanged, with no current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-connectivity/openssh/openssh_10.5p1.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
index e4b6ddef9d..b0d7962063 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
@@ -43,6 +43,8 @@ PAM_SRC_URI = "file://sshd"
 
 inherit manpages useradd update-rc.d update-alternatives systemd
 
+CVE_PRODUCT = "openbsd:openssh"
+
 USERADD_PACKAGES = "${PN}-sshd"
 USERADD_PARAM:${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd"
 INITSCRIPT_PACKAGES = "${PN}-sshd"
-- 
2.35.6