diff mbox series

avahi: correct CVE_PRODUCT mapping

Message ID 20260824110156.25632-1-devanshp@cisco.com
State Under Review
Headers show
Series avahi: correct CVE_PRODUCT mapping | expand

Commit Message

Devansh Patel Aug. 24, 2026, 11:01 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The current "avahi" mapping generates a vendor-wildcard product identity
for the packaged Avahi source.

Use "avahi:avahi", which matches the active NVD dictionary CPE, NVD
configuration criteria, and CNA affected data for the upstream project.

This changes the generated identity from
cpe:2.3:*:*:avahi:0.9~rc5:*:*:*:*:*:*:* to
cpe:2.3:*:avahi:avahi:0.9~rc5:*:*:*:*:*:*:*, but sbom-cve-check 1.3.3
with the frozen 2026-08-10 databases has no current CVE report delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-connectivity/avahi/avahi_0.9.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/avahi/avahi_0.9.bb b/meta/recipes-connectivity/avahi/avahi_0.9.bb
index 7cf0eb2b71..9397baa6ab 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.9.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.9.bb
@@ -29,6 +29,8 @@  SRC_URI = "git://github.com/avahi/avahi;protocol=https;branch=master;tag=v0.9-rc
 PV = "0.9~rc5"
 SRCREV = "71b640e686964efb27cb708f4457ffaed183c319"
 
+CVE_PRODUCT = "avahi:avahi"
+
 GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/"
 
 CVE_STATUS[CVE-2021-26720] = "not-applicable-platform: Issue only affects Debian/SUSE"