[PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE databases

[PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE databases

[Benjamin Robin (Schneider Electric)]

This series update sbom-cve-check to the latest release.
This release of sbom-cve-check addresses various fixes and improvements
as detailed in the changelog [1]

This series also updates the sbom-cve-check-update-* recipes to fetch
a more recent version of the CVE databases.

[1] https://github.com/bootlin/sbom-cve-check/blob/main/CHANGELOG.md#v133

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
Benjamin Robin (Schneider Electric) (3):
      python3-sbom-cve-check: update to version 1.3.3
      sbom-cve-check-update-cvelist-native: update to version 2026-08-03
      sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011

 ...{python3-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} | 2 +-
 ...2026-07-23.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 +-
 ...-000007.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)
---
base-commit: 6a91494f29a1f9da28280bc93771714c4545da46
change-id: 20260803-update-sbom-cve-check-1-3-3-d9347fb56ae6

Best regards,
--  
Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>

[PATCH 1/3] python3-sbom-cve-check: update to version 1.3.3

[Benjamin Robin (Schneider Electric)]

For details on this new release, see:
https://github.com/bootlin/sbom-cve-check/releases/tag/v1.3.3

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
 ...{python3-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
similarity index 82%
rename from meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
rename to meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
index f14901e3008f..2aca1005694b 100644
--- a/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.2.bb
+++ b/meta/recipes-devtools/sbom-cve-check/python3-sbom-cve-check_1.3.3.bb
@@ -5,7 +5,7 @@ LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=570a9b3749dd0463a1778803b12a6dce"
 
 PYPI_PACKAGE = "sbom_cve_check"
-SRC_URI[sha256sum] = "0a7f07a0c6ce45d40adc6d311ddc25c4466f59bafcbce149b6fb3663791a5d89"
+SRC_URI[sha256sum] = "8b766be1ae92b4eceaa2f694dd4724e310886c6436f44267a6bbc6a7b81ab8b9"
 
 inherit pypi python_hatchling
 

-- 
2.55.0

[PATCH 2/3] sbom-cve-check-update-cvelist-native: update to version 2026-08-03

[Benjamin Robin (Schneider Electric)]

Update cvelistV5 to the CVE database from 2026-08-03.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
 ...2026-07-23.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-08-03.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-08-03.bb
index 0ada6e89f3b3..b2a665450311 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-07-23.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-cvelist-native_2026-08-03.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/CVEProject/cvelistV5"
 SRC_URI = "git://github.com/CVEProject/cvelistV5.git;branch=main;protocol=https;destsuffix=;tag=${PV}_baseline"
 SBOM_CVE_CHECK_DB_NAME = "cvelist"
 
-SRCREV = "7a274ec07043f54c07d0a3b5c7fc89ba5793f023"
+SRCREV = "b160e6f2915ac726b29ee0689fc920f5016abef5"
 UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>.+)_baseline"
 
 require sbom-cve-check-update-db.inc

-- 
2.55.0

[PATCH 3/3] sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011

[Benjamin Robin (Schneider Electric)]

Update fkie-cad/nvd-json-data-feeds to the CVE database from 2026.08.03.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
 ...-000007.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.08.03-000011.bb
similarity index 89%
rename from meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb
rename to meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.08.03-000011.bb
index b0b6fb7d8c68..7c4c0511f830 100644
--- a/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.07.23-000007.bb
+++ b/meta/recipes-devtools/sbom-cve-check/sbom-cve-check-update-nvd-native_2026.08.03-000011.bb
@@ -6,7 +6,7 @@ HOMEPAGE = "https://github.com/fkie-cad/nvd-json-data-feeds"
 SRC_URI = "git://github.com/fkie-cad/nvd-json-data-feeds.git;branch=main;protocol=https;destsuffix=;tag=v${PV}"
 SBOM_CVE_CHECK_DB_NAME = "nvd-fkie"
 
-SRCREV = "64a0cea215628d780438fba8bfe0f3300db1b702"
+SRCREV = "b9f52bb052695dac5cabbd58e049eaac73697161"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.+)"
 
 require sbom-cve-check-update-db.inc

-- 
2.55.0

RE: [PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE databases

[Marko, Peter]

I have noticed that right after merging this commit, 9 historical CVEs were newly reported in Yocto master metrics.
(which is higher number than what was resolved by this update, which was 3 or 4).

All are caused by "no-version-ranges":

gnutls CVE-2023-0361
glibc CVE-2011-0536 
glibc CVE-2025-0577 (was "Fixed from version >2.40-17.fc41")
ovmf CVE-2017-5731
ovmf CVE-2019-14584
pulseaudio CVE-2020-15710
pulseaudio CVE-2020-16123
openssl CVE-2015-3216
ppp CVE-2020-15704 (was "Fixed from version 2.4.7-2\\+2ubuntu1.3")

I guess the two above which I extra commented are something which in theory could be looked at and handled in code?
The rest are unfortunately all data source issues.

I'll send annotations for all anyway...

Peter

> -----Original Message-----
> From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> Sent: Monday, August 3, 2026 11:26 AM
> To: openembedded-core@lists.openembedded.org
> Cc: ross.burton@arm.com; Marko, Peter (FT D EU SK BFS1)
> <Peter.Marko@siemens.com>; olivier.benjamin@bootlin.com; mathieu.dubois-
> briand@bootlin.com; thomas.petazzoni@bootlin.com; pascal.eberhard@se.com;
> wahid.essid@se.com; Benjamin Robin (Schneider Electric)
> <benjamin.robin@bootlin.com>
> Subject: [PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE
> databases
> 
> This series update sbom-cve-check to the latest release.
> This release of sbom-cve-check addresses various fixes and improvements
> as detailed in the changelog [1]
> 
> This series also updates the sbom-cve-check-update-* recipes to fetch
> a more recent version of the CVE databases.
> 
> [1] https://github.com/bootlin/sbom-cve-check/blob/main/CHANGELOG.md#v133
> 
> Signed-off-by: Benjamin Robin (Schneider Electric)
> <benjamin.robin@bootlin.com>
> ---
> Benjamin Robin (Schneider Electric) (3):
>       python3-sbom-cve-check: update to version 1.3.3
>       sbom-cve-check-update-cvelist-native: update to version 2026-08-03
>       sbom-cve-check-update-nvd-native: update to version 2026.08.03-000011
> 
>  ...{python3-sbom-cve-check_1.3.2.bb => python3-sbom-cve-check_1.3.3.bb} | 2
> +-
>  ...2026-07-23.bb => sbom-cve-check-update-cvelist-native_2026-08-03.bb} | 2 +-
>  ...-000007.bb => sbom-cve-check-update-nvd-native_2026.08.03-000011.bb} | 2
> +-
>  3 files changed, 3 insertions(+), 3 deletions(-)
> ---
> base-commit: 6a91494f29a1f9da28280bc93771714c4545da46
> change-id: 20260803-update-sbom-cve-check-1-3-3-d9347fb56ae6
> 
> Best regards,
> --
> Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>

Re: [PATCH 0/3] sbom-cve-check: Update to version 1.3.3 and update CVE databases

[Benjamin Robin]

Hello Peter,

On Wednesday, August 5, 2026 at 12:00 PM, Marko, Peter wrote:
> I have noticed that right after merging this commit, 9 historical CVEs were newly reported in Yocto master metrics.
> (which is higher number than what was resolved by this update, which was 3 or 4).
> 
> All are caused by "no-version-ranges":
> 
> gnutls CVE-2023-0361
> glibc CVE-2011-0536 
> glibc CVE-2025-0577 (was "Fixed from version >2.40-17.fc41")

For the CVE-2025-0577:
 - The NVD database does not provide any version range.
 - The CVE List database only provides the following ranges:
   - >= 2.39-28.fc40 , <= 2.39-33.fc40
   - >= 2.40-12.fc41 , <= 2.40-17.fc41

These ranges are no longer used, since the range contains a packaging distro
version. It is not possible (programmatically) to know that version
2.44 contains the fix for this CVE. Indeed the 2.40-17.fc41 may provide
an additional patch to fix that particular CVE.

See associated issue [1]

> ovmf CVE-2017-5731
> ovmf CVE-2019-14584
> pulseaudio CVE-2020-15710
> pulseaudio CVE-2020-16123
> openssl CVE-2015-3216
> ppp CVE-2020-15704 (was "Fixed from version 2.4.7-2\\+2ubuntu1.3")

For the CVE-2020-15704 this is exactly the same case as CVE-2025-0577.

> 
> I guess the two above which I extra commented are something which in theory could be looked at and handled in code?
> The rest are unfortunately all data source issues.
> 
> I'll send annotations for all anyway...

The proper way is to send an email to the CNA to fix these version ranges.
Most of the CNA that we contacted fixed the CVE entry pretty quickly.

CVE-2025-0577 and CVE-2020-15704 do not provide proper version ranges
(with upstream version). This is why sbom-cve-check indicates
"no-version-ranges".


[1] https://github.com/bootlin/sbom-cve-check/issues/26

Best regards,
-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com