From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 913C8C531D1 for ; Thu, 23 Jul 2026 15:34:22 +0000 (UTC) Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.26396.1784820860566081439 for ; Thu, 23 Jul 2026 08:34:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@baylibre.com header.s=google header.b=Wutmr3Ql; spf=pass (domain: baylibre.com, ip: 209.85.210.180, mailfrom: hfranco@baylibre.com) Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-8453427d3f4so788850b3a.3 for ; Thu, 23 Jul 2026 08:34:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baylibre.com; s=google; t=1784820860; x=1785425660; darn=lists.yoctoproject.org; h=content-disposition:content-description:content-type:mime-version :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zD6Xv8GoMsK0XouhmUXCvcpsY79t+5prZmn72B9JBAo=; b=Wutmr3Ql7QQcpPbDT6RZlRZHqwHwTHM209JRx6TDi7untS1FrfWrrkWS6nOuZIY5re hs2xopbfOg2RzhFezQhupeOy7J2A/AcdywjjAwUlRU8CZM8k+dXvILo6aqxxIGBbqRqG PBbchQ0mEYMxetd+XtfzK//46HzdVX2EfFpLpTH56hXrS5flDUObfqvEdctDmJRZBKXp ZCfekqSYJRslo/I8eEIpvvY+g3ue/PXF3BuZK61UO6iKCyNOK3sKs5vSdkFh365XPIVE XPl4Ja2r0UXiHapNv49O+hgUI7us0RNOYFLu0pIi+Pii161Whl2+NaYVBF31fV7MgRJu Tssw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784820860; x=1785425660; h=content-disposition:content-description:content-type:mime-version :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=zD6Xv8GoMsK0XouhmUXCvcpsY79t+5prZmn72B9JBAo=; b=Hm9uaI4fAJ8dnTTUzp0tNgV/7j61shJ+aueImUJMERd+OBYfx3UwY/HKmSeeXdVxuI h7/cv38f3GdvGIrd3oZZsuzf2xjIM6/Ayjgs09B0RttodK2HwTu0vR2FYkIPo0r8qKX1 kmAP7BBWIwF/19xLUYqccKC44ozD3mOa9zvQPgGmi/aIfHRIY2CDa3b+HM2C/1ZVOFRh kYG/4ZlA6kfzGMZIpRtLlkZMGEnvtX6tw97MOfI2RlQovuWEckZGSsHQEcgrvncNzwM8 QMKtHJJyTwkHkk4YoJSsTTmI5UVNPnsSlpIz5GXbuZUNhXyleaMm29zNZWbtA8Cl/T2h +XWQ== X-Gm-Message-State: AOJu0YzoiSwc+TFOtzTslFE2JPdJCz2YJ4T8cd9U33fUCUZzUX6KRM+5 3xwcMpbqt+kwN1mLFhvUAXUQTYxXxcAo9fgu4q502MZ66pCRgOBePYH4JMnpKjPFNdLzPOO0zbS EN10DHu4= X-Gm-Gg: AR+sD13EINYtRbd33goplsh87dyxKUbglOrB2LN2HqOHLjzN6++vllEd+ByZavICRNO chc+yXiMb2qJoftGJkmB6VDeJG8RTmF/qJ2UHdFyDf0Qq7Iz1+wlhordopCiXKrZVqlmET7CHaC ll0z2uPKnNZyCPCdRkR/b2HYxmOTU4W1MGVKyCbmUBXNxmk6bsrZQfSKtMso9YsGrNFXyaN/p+W 26lx2FSuhMdSIpzHBLXf1CYXGBN7YhAbaedeULXGIjteJNOvKT6OAMMiy42fCvn/dAcyYj1Ld30 vcr2fDwcG2V2sqLsxm/C+TYDsFucJsj3GApjUHeEi5oogyDU2YPm45i6tGEygxI2H4LSKliaqKz 7nFFQfrjri01Jbfy/SHnbhlxdjE5EsH2M3zRminxzQVtmckavh32Qs2OvDREijkIYtwcDv6Lv5w 9hk9cbCR49Xfdz/9fZNZKvOvZWG0480c3EIBnR X-Received: by 2002:a05:6a00:17a9:b0:848:2f7a:2e51 with SMTP id d2e1a72fcca58-84e2bb71daemr4335453b3a.64.1784820859938; Thu, 23 Jul 2026 08:34:19 -0700 (PDT) Received: from hiagonb ([2804:14c:4c5:9534::a19c]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84e17600a72sm3327354b3a.58.2026.07.23.08.34.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 08:34:19 -0700 (PDT) Date: Thu, 23 Jul 2026 12:34:16 -0300 From: Hiago De Franco To: yocto@lists.yoctoproject.org Cc: yocto-security@lists.yoctoproject.org Subject: [RESEND] Is it possible to correlate CVEs with packages instead of recipes? Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Description:  Content-Disposition: inline List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 15:34:22 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/66657 [Resending since I was not subscribed to the lists, sorry] Hello all, I am working with a project with Yocto Wrynose. By checking all the RPM packages installed into the OS build with Yocto I would like to check which CVEs affects this image and which binary packages are being affected. Yocto here is being used to serve the RPM packages to the image, after a 'bitbake world'. Since Yocto lists the CVEs per recipe, they all apply to all binary packages generated by the same recipe. Example: 'openssl' produces 'libcrypto', 'libssl', 'openssl-conf', etc., and they all have the same affected CVEs duplicaded by each package in my image. I was not able to find a good way to deduplicate the CVEs or to check which package produced by that recipe is being affected. Has anybody faced the same issue before or have any suggestions for this duplication problem with all the recipe CVEs? Best regards, Hiago.