Hi all,<br /><br />I think during&nbsp;<a href="https://git.openembedded.org/meta-openembedded-contrib/commit/?h=stable/dunfell-nut&amp;id=9ce3df8c2a10b45aa3695cf257aa27fd346d52a7" target="_blank" rel="noopener">https://git.openembedded.org/meta-openembedded-contrib/commit/?h=stable/dunfell-nut&amp;id=9ce3df8c2a10b45aa3695cf257aa27fd346d52a7</a>&nbsp;patch merge, PV variable is not updated and so&nbsp;<span style="font-family: monospace; font-size: 13.3333px; white-space: pre;">CVE-2020-14354 is reported by cve tool. So removing PV can solve this.<br /><br />I have verified using "bitbake -c cve_check c-ares" and after removing the PV variable, cve tool is not reporting </span><span style="font-family: monospace; font-size: 13.3333px; white-space: pre;">CVE-2020-14354 anymore.</span><span style="font-family: monospace; font-size: 13.3333px; white-space: pre;"><br /><br />Thanks,<br />Ranjitsinh</span>