[meta-virtualization][PATCH] podman: correct CVE_PRODUCT mapping

[meta-virtualization][PATCH] podman: correct CVE_PRODUCT mapping

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

The default product-only mapping cannot cover NVD records published under
Podman's former libpod name. podman_project:podman is the active NVD
dictionary CPE and configuration identity. libpod_project:libpod is the
historical NVD dictionary CPE and configuration identity for the same source
lineage, including records already referenced by recipe CVE_STATUS entries.

The exact pair retains all 23 records from the default mapping and adds
CVE-2018-10856, CVE-2019-10214, and CVE-2019-18466 from the historical NVD
identity.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 recipes-containers/podman/podman_git.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb
index e3bd1621..03e22e5d 100644
--- a/recipes-containers/podman/podman_git.bb
+++ b/recipes-containers/podman/podman_git.bb
@@ -29,6 +29,8 @@ GO_IMPORT = "import"
 
 PV = "6.1.0-dev"
 
+CVE_PRODUCT = "podman_project:podman libpod_project:libpod"
+
 CVE_STATUS[CVE-2019-10152] = "fixed-version: fixed since v1.4.0"
 CVE_STATUS[CVE-2020-1726] = "fixed-version: fixed since v1.8.1"
 CVE_STATUS[CVE-2022-2989] = "fixed-version: fixed since v4.3.0"
-- 
2.35.6

Re: [meta-virtualization][PATCH] podman: correct CVE_PRODUCT mapping

[Bruce Ashfield]

merged

Bruce