diff mbox series

libxml2: correct CVE_PRODUCT mapping

Message ID 20260826075347.63724-1-devanshp@cisco.com
State Under Review
Headers show
Series libxml2: correct CVE_PRODUCT mapping | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 26, 2026, 7:53 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The default product-only mapping generates a vendor-wildcard CPE.
xmlsoft:libxml2 is the active NVD dictionary CPE and configuration identity,
while gnome:libxml2 covers authoritative CNA affected data for the same
GNOME source, including two records exclusive to that backend identity.

This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 112-entry CVE report unchanged, with
no current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-core/libxml/libxml2_2.15.3.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-core/libxml/libxml2_2.15.3.bb b/meta/recipes-core/libxml/libxml2_2.15.3.bb
index 8b0ba29412..7ddba7429c 100644
--- a/meta/recipes-core/libxml/libxml2_2.15.3.bb
+++ b/meta/recipes-core/libxml/libxml2_2.15.3.bb
@@ -31,6 +31,8 @@  BINCONFIG = "${bindir}/xml2-config"
 
 inherit autotools pkgconfig binconfig-disabled ptest
 
+CVE_PRODUCT = "xmlsoft:libxml2 gnome:libxml2"
+
 # libxml2 publishes bugfix/security-only micro releases on its per-minor
 # release branches.
 inherit upstream-stable-release-point