From 9ca56203896ca8d8f00580a241eb767b855b769e Mon Sep 17 00:00:00 2001 From: Devansh Patel Date: Fri, 11 Sep 2026 02:22:56 -0700 Subject: [PATCH] python3-py: correct CVE_PRODUCT mapping The product-only "py" mapping generates a wildcard-vendor identity instead of the exact NVD identity for the packaged pytest-dev py source. Use "pytest:py" for its NVD dictionary CPE and configuration matches. This changes the generated product identity. With sbom-cve-check 1.3.3, the current CVE report is unchanged using the pinned database snapshots; both mappings report CVE-2020-29651 and CVE-2022-42969. Signed-off-by: Devansh Patel Signed-off-by: Khem Raj (cherry picked from commit 26fa8b053b71d1f3f8da359abaef578c671c692f) Signed-off-by: Darsh Kelaiya Signed-off-by: Anuj Mittal --- meta-python/recipes-devtools/python/python3-py_1.11.0.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-python/recipes-devtools/python/python3-py_1.11.0.bb b/meta-python/recipes-devtools/python/python3-py_1.11.0.bb index 61f3873b4c..76cb4ce745 100644 --- a/meta-python/recipes-devtools/python/python3-py_1.11.0.bb +++ b/meta-python/recipes-devtools/python/python3-py_1.11.0.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a6bb0320b04a0a503f12f69fea479de9" SRC_URI[sha256sum] = "51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719" -CVE_PRODUCT = "py" +CVE_PRODUCT = "pytest:py" CVE_STATUS[CVE-2022-42969] = "disputed: upstream could not reproduce it, github also revoked the advisory" DEPENDS += "python3-setuptools-scm-native"