From c978045d537b4320d2b09d2d98e686d532a8aec3 Mon Sep 17 00:00:00 2001 From: Devansh Patel Date: Wed, 23 Sep 2026 22:40:46 +1200 Subject: [PATCH] php: correct CVE_PRODUCT mapping The default product-only mapping generates a vendor-wildcard CPE. php:php is the active NVD dictionary CPE and configuration identity. php_group:php preserves historical NVD configurations and current authoritative PHP Security CNA affected data for the same php-src source; it is not an NVD dictionary CPE. This changes the generated identities to two exact CPEs, but the frozen sbom-cve-check database leaves the 731-entry CVE report unchanged, with no current CVE delta. Signed-off-by: Devansh Patel Signed-off-by: Khem Raj (cherry picked from commit 4b8eedb7d26387005924e6035f178b1d56dd33e9) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- meta-oe/recipes-devtools/php/php_8.5.10.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-devtools/php/php_8.5.10.bb b/meta-oe/recipes-devtools/php/php_8.5.10.bb index aab18777c7..130a98f634 100644 --- a/meta-oe/recipes-devtools/php/php_8.5.10.bb +++ b/meta-oe/recipes-devtools/php/php_8.5.10.bb @@ -34,6 +34,8 @@ S = "${UNPACKDIR}/php-${PV}" SRC_URI[sha256sum] = "d79bd4f3a9248e5cb5833766ba0d51cd35dd01b8727f23f30bcdba6fabc51d3e" +CVE_PRODUCT = "php:php php_group:php" + CVE_STATUS_GROUPS += "CVE_STATUS_PHP" CVE_STATUS_PHP[status] = "fixed-version: The name of this product is exactly the same as github.com/emlog/emlog. CVE can be safely ignored." CVE_STATUS_PHP = " \