[meta-virtualization][wrynose][PATCH] docker-compose: add CVE_PRODUCT and CVE_STATUS for CVE-2025-62725

[meta-virtualization][wrynose][PATCH] docker-compose: add CVE_PRODUCT and CVE_STATUS for CVE-2025-62725

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: "mark.yang" <mark.yang@lge.com>

Add CVE_PRODUCT to docker-compose that matches CPE.
<vendor>:<product> must be set to docker:compose for proper matching.

CVE-2025-62725 was fixed in 2.40.2, but its record encodes the range as
a plain "< 2.40.2" version string that automated version comparison
cannot use, so mark it as fixed-version.

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
(cherry picked from commit e456f38266f55e32521903cddd8a0f9fee2fd5eb)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 recipes-containers/docker-compose/docker-compose_git.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/recipes-containers/docker-compose/docker-compose_git.bb b/recipes-containers/docker-compose/docker-compose_git.bb
index 3eb78c04..aa61d245 100644
--- a/recipes-containers/docker-compose/docker-compose_git.bb
+++ b/recipes-containers/docker-compose/docker-compose_git.bb
@@ -30,6 +30,10 @@ GO_IMPORT = "import"
 
 PV = "5.1.0"
 
+CVE_PRODUCT = "docker:compose"
+
+CVE_STATUS[CVE-2025-62725] = "fixed-version: fixed in 2.40.2"
+
 COMPOSE_PKG = "github.com/docker/compose/v2"
 
 # go-mod-discovery configuration
-- 
2.53.0

Re: [meta-virtualization][wrynose][PATCH] docker-compose: add CVE_PRODUCT and CVE_STATUS for CVE-2025-62725

[Bruce Ashfield]

merged

Bruce