[meta-python][PATCH] python3-pymongo: correct CVE_PRODUCT mapping
"Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" <[email protected]>
| Newsgroups | org.openembedded.lists.openembedded-devel |
|---|---|
| Message-ID | <[email protected]> |
From: Devansh Patel <[email protected]> The product-only "pymongo" value emits a wildcard-vendor identity and omits the second authoritative name for the packaged MongoDB Python driver. Use "mongodb:python_driver" for its NVD dictionary CPE family and "mongodb:pymongo" for its NVD dictionary CPE and configuration identity. With sbom-cve-check 1.3.3 and the pinned database snapshots, the generated product identity changes; the current CVE report is unchanged. Signed-off-by: Devansh Patel <[email protected]> --- meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb b/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb index 663de17352..4255650834 100644 --- a/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb +++ b/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb @@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327" SRC_URI[sha256sum] = "70ffa08ba641468cc068cf46c06b34f01a8ce3489f6411309fcb5ceabe6b2fc0" -CVE_PRODUCT = "pymongo" +CVE_PRODUCT = "mongodb:python_driver mongodb:pymongo" inherit pypi python_hatchling -- 2.35.6