diff mbox series

[meta-python,wrynose,37/42] python3-aiohttp: correct CVE_PRODUCT mapping

Message ID 20260923104056.457360-37-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/42] c-ares: mark CVEs fixed | expand

Commit Message

Ankur Tyagi Sept. 23, 2026, 10:40 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

The current "aiohttp" mapping emits the wildcard-vendor *:aiohttp CPE
instead of the exact NVD identity for the packaged aio-libs/aiohttp
source.

Use "aiohttp:aiohttp", which is both an NVD dictionary CPE and an NVD
configuration identity. CNA affected data uses "aio-libs:aiohttp" and
remains covered by scanner aliases. With sbom-cve-check 1.3.3 and the
pinned 2026-08-12 data, the generated identity changes but the current
CVE report does not.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 33d7be43195b58c66f6ef32d1f4837af085b37ac)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-python/recipes-devtools/python/python3-aiohttp_3.13.5.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.13.5.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.13.5.bb
index b9d08ac97b..67dd8a1e40 100644
--- a/meta-python/recipes-devtools/python/python3-aiohttp_3.13.5.bb
+++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.13.5.bb
@@ -19,7 +19,7 @@  SRC_URI += " \
     file://CVE-2026-54280.patch \
 "
 
-CVE_PRODUCT = "aiohttp"
+CVE_PRODUCT = "aiohttp:aiohttp"
 CVE_STATUS_GROUPS = "CVE_AIOHTTP_FIX_3_13_4"
 CVE_AIOHTTP_FIX_3_13_4[status] = "fixed-version: fixed in 3.13.4"
 CVE_AIOHTTP_FIX_3_13_4 = "CVE-2026-22815 CVE-2026-34513 CVE-2026-34514 \