From fb27cbf27add45bc1a23e6e9a467b1071efa1e8f Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 31 Oct 2025 14:04:11 +1300 Subject: [PATCH] mercurial: set CVE_PRODUCT to "mercurial-scm:mercurial mercurial:mercurial" Other product "mercurial" introduce false CVE finding like: https://nvd.nist.gov/vuln/detail/CVE-2022-43410 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj --- meta-oe/recipes-devtools/mercurial/mercurial_6.6.3.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-oe/recipes-devtools/mercurial/mercurial_6.6.3.bb b/meta-oe/recipes-devtools/mercurial/mercurial_6.6.3.bb index a312be4aa7..3fa692029e 100644 --- a/meta-oe/recipes-devtools/mercurial/mercurial_6.6.3.bb +++ b/meta-oe/recipes-devtools/mercurial/mercurial_6.6.3.bb @@ -34,4 +34,4 @@ PACKAGES =+ "${PN}-python" FILES:${PN} += "${PYTHON_SITEPACKAGES_DIR} ${datadir}" FILES:${PN}-python = "${nonarch_libdir}/${PYTHON_DIR}" -CVE_STATUS[CVE-2022-43410] = "cpe-incorrect: The recipe used in the `meta-openembedded` is a different mercurial package compared to the one which has the CVE issue." +CVE_PRODUCT = "mercurial-scm:mercurial mercurial:mercurial"