diff mbox series

python3-lxml: correct CVE_PRODUCT mapping

Message ID 20260821125945.59739-1-devanshp@cisco.com
State New
Headers show
Series python3-lxml: correct CVE_PRODUCT mapping | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 21, 2026, 12:59 p.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The current product-only "lxml" mapping generates a wildcard-vendor
product identity instead of the vendor assigned to the packaged project.

Use "lxml:lxml" for its exact NVD dictionary CPE, NVD configuration,
and CNA affected-data identity. This changes the generated CPE, but the
current CVE report is unchanged with sbom-cve-check 1.3.3 and the pinned
NVD snapshot.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-devtools/python/python3-lxml_6.1.1.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-lxml_6.1.1.bb b/meta/recipes-devtools/python/python3-lxml_6.1.1.bb
index 4ca7f08b39..da19905f89 100644
--- a/meta/recipes-devtools/python/python3-lxml_6.1.1.bb
+++ b/meta/recipes-devtools/python/python3-lxml_6.1.1.bb
@@ -39,6 +39,6 @@  BBCLASSEXTEND = "native nativesdk"
 
 RDEPENDS:${PN} += "libxml2 libxslt python3-compression"
 
-CVE_PRODUCT = "lxml"
+CVE_PRODUCT = "lxml:lxml"
 
 CLEANBROKEN = "1"