diff mbox series

binutils: correct CVE_PRODUCT mapping

Message ID 20260824110156.25702-1-devanshp@cisco.com
State Under Review
Headers show
Series binutils: correct CVE_PRODUCT mapping | expand

Commit Message

Devansh Patel Aug. 24, 2026, 11:01 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The current "binutils" mapping generates a vendor-wildcard product
identity for the packaged GNU Binutils source.

Use "gnu:binutils", which matches the active NVD dictionary CPE, NVD
configuration criteria, and CNA affected data for the Sourceware project.

This changes the generated identity from
cpe:2.3:*:*:binutils:2.47:*:*:*:*:*:*:* to
cpe:2.3:*:gnu:binutils:2.47:*:*:*:*:*:*:*, but sbom-cve-check 1.3.3
with the frozen 2026-08-10 databases has no current CVE report delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-devtools/binutils/binutils_2.47.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/binutils/binutils_2.47.bb b/meta/recipes-devtools/binutils/binutils_2.47.bb
index 79bcac2025..798d886614 100644
--- a/meta/recipes-devtools/binutils/binutils_2.47.bb
+++ b/meta/recipes-devtools/binutils/binutils_2.47.bb
@@ -1,6 +1,8 @@ 
 require binutils.inc
 require binutils-${PV}.inc
 
+CVE_PRODUCT = "gnu:binutils"
+
 # perl-native for pod2man for man page generation
 DEPENDS += "zlib perl-native"