RE: [PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE databases

["Marko, Peter" <Peter.Marko@siemens.com>]

I have noticed that right after merging this commit, 9 historical CVEs were newly reported in Yocto master metrics.
(which is higher number than what was resolved by this update, which was 3 or 4).

All are caused by "no-version-ranges":

gnutls CVE-2023-0361
glibc CVE-2011-0536 
glibc CVE-2025-0577 (was "Fixed from version >2.40-17.fc41")
ovmf CVE-2017-5731
ovmf CVE-2019-14584
pulseaudio CVE-2020-15710
pulseaudio CVE-2020-16123
openssl CVE-2015-3216
ppp CVE-2020-15704 (was "Fixed from version 2.4.7-2\\+2ubuntu1.3")

I guess the two above which I extra commented are something which in theory could be looked at and handled in code?
The rest are unfortunately all data source issues.

I'll send annotations for all anyway...

Peter

> -----Original Message-----
> From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> Sent: Monday, August 3, 2026 11:26 AM
> To: openembedded-core@lists.openembedded.org
> Cc: ross.burton@arm.com; Marko, Peter (FT D EU SK BFS1)
> <Peter.Marko@siemens.com>; olivier.benjamin@bootlin.com; mathieu.dubois-
> briand@bootlin.com; thomas.petazzoni@bootlin.com; pascal.eberhard@se.com;
> wahid.essid@se.com; Benjamin Robin (Schneider Electric)
> <benjamin.robin@bootlin.com>
> Subject: [PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE
> databases
> 
> This series update sbom-cve-check to the latest release.
> This release of sbom-cve-check addresses various fixes and improvements
> as detailed in the changelog [1]
> 
> This series also updates the sbom-cve-check-update-* recipes to fetch
> a more recent version of the CVE databases.
> 
> [1] https://github.com/bootlin/sbom-cve-check/blob/main/CHANGELOG.md#v133
> 
> Signed-off-by: Benjamin Robin (Schneider Electric)
> <benjamin.robin@bootlin.com>
> ---
> Benjamin Robin (Schneider Electric) (3):
>       python3-sbom-cve-check: update to version 1.3.3
>       sbom-cve-check-update-cvelist-native: update to version 2026-08-03
>       sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011
> 
>  ...{python3-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} | 2
> +-
>  ...2026-07-23.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 +-
>  ...-000007.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2
> +-
>  3 files changed, 3 insertions(+), 3 deletions(-)
> ---
> base-commit: 6a91494f29a1f9da28280bc93771714c4545da46
> change-id: 20260803-update-sbom-cve-check-1-3-3-d9347fb56ae6
> 
> Best regards,
> --
> Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>