Re: [OE-core] [master] [PATCH] apt: Add CVE_PRODUCT to support product name

[Paul Barker <paul@pbarker.dev>]

[-- Attachment #1: Type: text/plain, Size: 1626 bytes --]

On Tue, 2026-04-21 at 04:10 -0700, Himanshu Jadon -X (hjadon - E
INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Himanshu Jadon <hjadon@cisco.com>
> 
> - NVD contains older debian:apt CPEs, but they are deprecated and
>   explicitly replaced by debian:advanced_package_tool, so the recipe
>   should use the active normalized product identity.
> - Therefore, set CVE_PRODUCT to align with the NVD CPE and ensure
>   correct CVE reporting.
> 
> Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
> ---
>  meta/recipes-devtools/apt/apt_3.0.3.bb | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/meta/recipes-devtools/apt/apt_3.0.3.bb b/meta/recipes-devtools/apt/apt_3.0.3.bb
> index d2dfe48e9a..871564baea 100644
> --- a/meta/recipes-devtools/apt/apt_3.0.3.bb
> +++ b/meta/recipes-devtools/apt/apt_3.0.3.bb
> @@ -148,3 +148,6 @@ do_install:append() {
>  	# Avoid non-reproducible -src package
>  	sed -i -e "s,${B}/include/,,g" ${B}/apt-pkg/tagfile-keys.cc
>  }
> +
> +# Add CVE_PRODUCT to match the NVD CPE product name
> +CVE_PRODUCT = "debian:advanced_package_tool"

CVE-2020-3810 [1] appears to have CPE "debian:apt" but not
"debian:advanced_package_tool", so I don't think we should exclude the
older CPE here.

[1]: https://nvd.nist.gov/vuln/detail/CVE-2020-3810

What is the goal of this patch and other patches from Cisco which set
CVE_PRODUCT? In most cases there don't seem to be any false positives
that you're trying to resolve, so I'm still unsure why CVE_PRODUCT needs
to be set in so many recipes.

Best regards,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]