Re: [scarthgap][PATCH v2 2/3] python3-py: correct CVE_PRODUCT mapping

["Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" <dkelaiya@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 2249 bytes --]

On Fri, Sep 11, 2026 at 01:37 PM, Yoann Congal wrote:

> 
> On Wed Sep 2, 2026 at 8:09 AM CEST, Darsh Kelaiya -X (dkelaiya - E
> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> 
>> From: Devansh Patel <devanshp@cisco.com>
>> 
>> The product-only "py" mapping generates a wildcard-vendor identity
>> instead of the exact NVD identity for the packaged pytest-dev py
>> source. Use "pytest:py" for its NVD dictionary CPE and configuration
>> matches.
>> 
>> This changes the generated product identity. With sbom-cve-check 1.3.3,
>> the current CVE report is unchanged using the pinned database snapshots;
>> both mappings report CVE-2020-29651 and CVE-2022-42969.
>> 
>> Signed-off-by: Devansh Patel <devanshp@cisco.com>
>> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
>> (cherry picked from commit 26fa8b053b71d1f3f8da359abaef578c671c692f)
>> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
>> ---
>> meta/recipes-devtools/python/python3-py_1.11.0.bb | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/meta/recipes-devtools/python/python3-py_1.11.0.bb
>> b/meta/recipes-devtools/python/python3-py_1.11.0.bb
>> index a75b9c2b14..906410e9bb 100644
>> --- a/meta/recipes-devtools/python/python3-py_1.11.0.bb
>> +++ b/meta/recipes-devtools/python/python3-py_1.11.0.bb
>> @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM =
>> "file://LICENSE;md5=a6bb0320b04a0a503f12f69fea479de9"
>> 
>> SRC_URI[sha256sum] =
>> "51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719"
>> 
>> -CVE_PRODUCT = "py"
>> +CVE_PRODUCT = "pytest:py"
>> 
>> DEPENDS += "python3-setuptools-scm-native"
> 
> Hello,
> 
> As far as I can tell, this is also needed on meta-oe/wrynose. Can you
> send a backport there, please?
> 
> Since patches 2&3/3 conflicts, I'll hold both until "python3-py: correct
> CVE_PRODUCT mapping" lands on meta-oe/wrynose.
> 
> Baring future issues, I'll take 1/3.
> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

Hello Yoann,

Thanks for highlighting this. I've sent the requested "python3-py: correct CVE_PRODUCT mapping" as shown here for Wrynose:

https://lists.openembedded.org/g/openembedded-devel/message/129959

Regards,
Darsh Kelaiya

[-- Attachment #2: Type: text/html, Size: 2516 bytes --]