diff mbox series

nghttp2: correct CVE_PRODUCT mapping

Message ID 20260826075347.63861-1-devanshp@cisco.com
State Under Review
Headers show
Series nghttp2: correct CVE_PRODUCT mapping | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 26, 2026, 7:53 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The default product-only mapping generates a vendor-wildcard CPE.
nghttp2:nghttp2 is the sole active NVD dictionary CPE and configuration
identity, and is also used by CNA affected data for the packaged source.

This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the nine-entry CVE report unchanged,
with no current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-support/nghttp2/nghttp2_1.70.0.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb b/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb
index 1b09f91ce6..bfb7d4ba42 100644
--- a/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb
+++ b/meta/recipes-support/nghttp2/nghttp2_1.70.0.bb
@@ -10,6 +10,8 @@  SRC_URI[sha256sum] = "e05cb1388eaca3830aded4ccf20044b6e1ac1a61411dcca11b0437c428
 
 inherit cmake manpages python3native github-releases
 
+CVE_PRODUCT = "nghttp2:nghttp2"
+
 PACKAGECONFIG[manpages] = "-DENABLE_DOC=ON,-DENABLE_DOC=OFF"
 
 EXTRA_OECMAKE = "-DENABLE_LIB_ONLY=ON -DENABLE_PYTHON_BINDINGS=OFF"