diff mbox series

openssh: correct CVE_PRODUCT mapping

Message ID 20260826085706.17841-1-devanshp@cisco.com
State New
Headers show
Series openssh: correct CVE_PRODUCT mapping | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 26, 2026, 8:57 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The default product-only mapping generates a vendor-wildcard CPE. NVD
deprecates each openssh:openssh record in favor of openbsd:openssh, the
active dictionary CPE and configuration identity for the packaged source.
The deprecated spelling has no exclusive CVEs in the frozen backend.

This changes the generated product identity to the active exact CPE, but
the frozen sbom-cve-check database leaves the 137-entry CVE report
unchanged, with no current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 meta/recipes-connectivity/openssh/openssh_10.5p1.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
index e4b6ddef9d..b0d7962063 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
@@ -43,6 +43,8 @@  PAM_SRC_URI = "file://sshd"
 
 inherit manpages useradd update-rc.d update-alternatives systemd
 
+CVE_PRODUCT = "openbsd:openssh"
+
 USERADD_PACKAGES = "${PN}-sshd"
 USERADD_PARAM:${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd"
 INITSCRIPT_PACKAGES = "${PN}-sshd"