mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-31 15:51:17 +00:00
Code Issues Projects Releases Wiki Activity

php: correct CVE_PRODUCT mapping

Browse Source 
The default product-only mapping generates a vendor-wildcard CPE. php:php
is the active NVD dictionary CPE and configuration identity. php_group:php
preserves historical NVD configurations and current authoritative PHP
Security CNA affected data for the same php-src source; it is not an NVD
dictionary CPE.

This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 731-entry CVE report unchanged, with no
current CVE delta.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Devansh Patel
2026-08-26 10:26:42 -07:00
committed by Khem Raj
parent f1c88ff462
commit 4b8eedb7d2
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/php/php_8.5.9.bb
+2
View File
@@ -34,6 +34,8 @@ S = "${UNPACKDIR}/php-${PV}"
SRC_URI[sha256sum] = "703c082ad9d2946ac647f3596812300d2c62b360d2f31a999021692a9b39476c"
CVE_PRODUCT = "php:php php_group:php"
CVE_STATUS_GROUPS += "CVE_STATUS_PHP"
CVE_STATUS_PHP[status] = "fixed-version: The name of this product is exactly the same as github.com/emlog/emlog. CVE can be safely ignored."
CVE_STATUS_PHP = " \