[meta-virtualization][PATCH] podman: correct CVE_PRODUCT mapping
"Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" <[email protected]>
| Newsgroups | org.yoctoproject.lists.meta-virtualization |
|---|---|
| Message-ID | <[email protected]> |
From: Devansh Patel <[email protected]> The default product-only mapping cannot cover NVD records published under Podman's former libpod name. podman_project:podman is the active NVD dictionary CPE and configuration identity. libpod_project:libpod is the historical NVD dictionary CPE and configuration identity for the same source lineage, including records already referenced by recipe CVE_STATUS entries. The exact pair retains all 23 records from the default mapping and adds CVE-2018-10856, CVE-2019-10214, and CVE-2019-18466 from the historical NVD identity. Signed-off-by: Devansh Patel <[email protected]> --- recipes-containers/podman/podman_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb index e3bd1621..03e22e5d 100644 --- a/recipes-containers/podman/podman_git.bb +++ b/recipes-containers/podman/podman_git.bb @@ -29,6 +29,8 @@ GO_IMPORT = "import" PV = "6.1.0-dev" +CVE_PRODUCT = "podman_project:podman libpod_project:libpod" + CVE_STATUS[CVE-2019-10152] = "fixed-version: fixed since v1.4.0" CVE_STATUS[CVE-2020-1726] = "fixed-version: fixed since v1.8.1" CVE_STATUS[CVE-2022-2989] = "fixed-version: fixed since v4.3.0" -- 2.35.6