Re: [OE-core] [PATCH 3/5] zlib: ignore CVE-2023-6992

Ross Burton
2024-01-22T14:27:12Z

On 22 Jan 2024, at 14:16, Marko, Peter <Peter.Marko@siemens.com> wrote:
>
> Hi Ross,
>
> I think this one is better - https://lists.openembedded.org/g/openembedded-core/message/193603
> I'm not sure why it was not picked up yet after 9 days, but It's CPE which is not matching, not our configuration options…

Ah I didn’t see that.

However the CPE _is_ correct, its our matching which is not. I assumed there wasn’t enough consistency in the zlib CPEs that we could set one with a vendor.

Ross