Re: [yocto] Is it possible to correlate CVEs with packages instead of recipes?

Daniel Turull <[email protected]> Mon, 27 Jul 2026 06:28:20 +0000

Newsgroups	org.yoctoproject.lists.yocto
Message-ID	<[email protected]>

T24gVGh1LCAyMDI2LTA3LTIzIGF0IDEyOjI1IC0wMzAwLCBIaWFnbyBEZSBGcmFuY28gdmlhIGxp
c3RzLnlvY3RvcHJvamVjdC5vcmcgd3JvdGU6DQo+IFtZb3UgZG9uJ3Qgb2Z0ZW4gZ2V0IGVtYWls
IGZyb20gaGZyYW5jbz1iYXlsaWJyZS5jb21AbGlzdHMueW9jdG9wcm9qZWN0Lm9yZy4gTGVhcm4g
d2h5IHRoaXMgaXMNCj4gaW1wb3J0YW50IGF0IGh0dHBzOi8vYWthLm1zL0xlYXJuQWJvdXRTZW5k
ZXJJZGVudGlmaWNhdGlvbsKgXQ0KPiANCj4gSGVsbG8gYWxsLA0KPiANCj4gSSBhbSB3b3JraW5n
IHdpdGggYSBwcm9qZWN0IHdpdGggWW9jdG8gV3J5bm9zZS4gQnkgY2hlY2tpbmcgYWxsIHRoZQ0K
PiBSUE0gcGFja2FnZXMgaW5zdGFsbGVkIGludG8gdGhlIE9TIGJ1aWxkIHdpdGggWW9jdG8gSSB3
b3VsZCBsaWtlIHRvDQo+IGNoZWNrIHdoaWNoIENWRXMgYWZmZWN0cyB0aGlzIGltYWdlIGFuZCB3
aGljaCBiaW5hcnkgcGFja2FnZXMgYXJlIGJlaW5nDQo+IGFmZmVjdGVkLg0KPiANCj4gWW9jdG8g
aGVyZSBpcyBiZWluZyB1c2VkIHRvIHNlcnZlIHRoZSBSUE0gcGFja2FnZXMgdG8gdGhlIGltYWdl
LCBhZnRlciBhDQo+ICdiaXRiYWtlIHdvcmxkJy4gU2luY2UgWW9jdG8gbGlzdHMgdGhlIENWRXMg
cGVyIHJlY2lwZSwgdGhleSBhbGwgYXBwbHkNCj4gdG8gYWxsIGJpbmFyeSBwYWNrYWdlcyBnZW5l
cmF0ZWQgYnkgdGhlIHNhbWUgcmVjaXBlLg0KPiANCj4gRXhhbXBsZTogJ29wZW5zc2wnIHByb2R1
Y2VzICdsaWJjcnlwdG8nLCAnbGlic3NsJywgJ29wZW5zc2wtY29uZicsIGV0Yy4sDQo+IGFuZCB0
aGV5IGFsbCBoYXZlIHRoZSBzYW1lIGFmZmVjdGVkIENWRXMgZHVwbGljYWRlZCBieSBlYWNoIHBh
Y2thZ2UgaW4NCj4gbXkgaW1hZ2UuDQo+IA0KPiBJIHdhcyBub3QgYWJsZSB0byBmaW5kIGEgZ29v
ZCB3YXkgdG8gZGVkdXBsaWNhdGUgdGhlIENWRXMgb3IgdG8gY2hlY2sNCj4gd2hpY2ggcGFja2Fn
ZSBwcm9kdWNlZCBieSB0aGF0IHJlY2lwZSBpcyBiZWluZyBhZmZlY3RlZC4gSGFzIGFueWJvZHkN
Cj4gZmFjZWQgdGhlIHNhbWUgaXNzdWUgYmVmb3JlIG9yIGhhdmUgYW55IHN1Z2dlc3Rpb25zIGZv
ciB0aGlzIGR1cGxpY2F0aW9uDQo+IHByb2JsZW0gd2l0aCBhbGwgdGhlIHJlY2lwZSBDVkVzPw0K
DQpZb3UgY291bGQgcGFyc2UgdGhlIHNib20gYW5kIGZpbmQgdGhlIHJlY2lwZSB0aGF0IGNyZWF0
ZXMgdGhlIHJwbSBwYWNrYWdlIGFuZCB1c2UgaXQgYXMga2V5IHRvDQpkZWR1cGxpY2F0ZSBpdC4N
Cg0KQmVzdCByZWdhcmRzLA0KRGFuaWVsDQo+IA0KPiBCZXN0IHJlZ2FyZHMsDQo+IEhpYWdvLg0K
DQo=