diff mbox series

patch: correct CVE_PRODUCT mapping

Message ID 20260826075348.63928-1-devanshp@cisco.com
State Under Review
Headers show
Series patch: correct CVE_PRODUCT mapping | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 26, 2026, 7:53 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The default product-only mapping also matches the unrelated Tanium Patch
product. gnu:patch is the active NVD dictionary CPE and configuration
identity, and is also used by CNA affected data for the packaged GNU source.

This retains all 15 GNU patch records, including the two current-version
CVEs already fixed by recipe patches, while removing three Tanium false
positives.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-devtools/patch/patch_2.8.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/patch/patch_2.8.bb b/meta/recipes-devtools/patch/patch_2.8.bb
index 6317ac775d..33142ac574 100644
--- a/meta/recipes-devtools/patch/patch_2.8.bb
+++ b/meta/recipes-devtools/patch/patch_2.8.bb
@@ -1,6 +1,8 @@ 
 require patch.inc
 LICENSE = "GPL-3.0-only"
 
+CVE_PRODUCT = "gnu:patch"
+
 SRC_URI[sha256sum] = "308a4983ff324521b9b21310bfc2398ca861798f02307c79eb99bb0e0d2bf980"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"