From 3ea522b0ecc959c9d157ffd6bf8aa71a4946d345 Mon Sep 17 00:00:00 2001 From: Devansh Patel Date: Fri, 21 Aug 2026 05:59:45 -0700 Subject: [PATCH] python3-pymongo: correct CVE_PRODUCT mapping The product-only "pymongo" value emits a wildcard-vendor identity and omits the second authoritative name for the packaged MongoDB Python driver. Use "mongodb:python_driver" for its NVD dictionary CPE family and "mongodb:pymongo" for its NVD dictionary CPE and configuration identity. With sbom-cve-check 1.3.3 and the pinned database snapshots, the generated product identity changes; the current CVE report is unchanged. Signed-off-by: Devansh Patel Signed-off-by: Khem Raj --- meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb b/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb index 663de17352..4255650834 100644 --- a/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb +++ b/meta-python/recipes-devtools/python/python3-pymongo_4.17.0.bb @@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327" SRC_URI[sha256sum] = "70ffa08ba641468cc068cf46c06b34f01a8ce3489f6411309fcb5ceabe6b2fc0" -CVE_PRODUCT = "pymongo" +CVE_PRODUCT = "mongodb:python_driver mongodb:pymongo" inherit pypi python_hatchling