diff mbox series

[meta-oe] nodejs: add CVE_PRODUCT

Message ID 20230208050536.110196-1-Qi.Chen@windriver.com
State Under Review
Headers show
Series [meta-oe] nodejs: add CVE_PRODUCT | expand

Commit Message

ChenQi Feb. 8, 2023, 5:05 a.m. UTC 
Some old nodejs CVEs use 'nodejs', and recent nodejs CVEs use
'node.js'. Add CVE_PRODUCT to include both.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta-oe/recipes-devtools/nodejs/nodejs_18.12.1.bb | 2 ++
 1 file changed, 2 insertions(+)

Comments

Ross Burton Feb. 8, 2023, 12:32 p.m. UTC | #1 
On 8 Feb 2023, at 05:05, Chen Qi via lists.openembedded.org <Qi.Chen=windriver.com@lists.openembedded.org> wrote:
> 
> Some old nodejs CVEs use 'nodejs', and recent nodejs CVEs use
> 'node.js'. Add CVE_PRODUCT to include both.

You can also email NIST and they’ll correct the database to remove this confusion.

Ross
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/nodejs/nodejs_18.12.1.bb b/meta-oe/recipes-devtools/nodejs/nodejs_18.12.1.bb
index e96913e56..96e70991b 100644
--- a/meta-oe/recipes-devtools/nodejs/nodejs_18.12.1.bb
+++ b/meta-oe/recipes-devtools/nodejs/nodejs_18.12.1.bb
@@ -3,6 +3,8 @@  HOMEPAGE = "http://nodejs.org"
 LICENSE = "MIT & ISC & BSD-2-Clause & BSD-3-Clause & Artistic-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=dfd7ae796baf5326016a3865ee1dc632"
 
+CVE_PRODUCT = "nodejs node.js"
+
 DEPENDS = "openssl"
 DEPENDS:append:class-target = " qemu-native"
 DEPENDS:append:class-native = " c-ares-native"