summaryrefslogtreecommitdiffstats
path: root/documentation/ref-manual
diff options
context:
space:
mode:
authorPeter Marko <peter.marko@siemens.com>2025-07-09 20:51:41 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2025-07-14 17:49:48 +0100
commit1eea8922a76953e48937e10f85dcea534f42b1bb (patch)
tree025f2e4eb9a145b0a7ad014112a6b7420002f64a /documentation/ref-manual
parent80f02155ca4acfc5c87883366c2927266b38e9a1 (diff)
downloadpoky-1eea8922a76953e48937e10f85dcea534f42b1bb.tar.gz
python3: update CVE product
There are two "new" CVEs reported for python3, their CPEs are: * CVE-2020-1171: cpe:2.3:a:microsoft:python:*:*:*:*:*:visual_studio_code:*:* (< 2020.5.0) * CVE-2020-1192: cpe:2.3:a:microsoft:python:*:*:*:*:*:visual_studio_code:*:* (< 2020.5.0) These are for "Visual Studio Code Python extension". Solve this by addding CVE vendor to python CVE product to avoid confusion with Microsoft as vendor. Examining CVE DB for historical python entries shows: sqlite> select vendor, product, count(*) from products where product = 'python' or product = 'cpython' ...> or product like 'python%3' group by vendor, product; microsoft|python|2 python|python|1054 python_software_foundation|python|2 Note that this already shows that cpython product is not used, so CVE-2023-33595 mentioned in 62598e1138f21a16d8b1cdd1cfe902aeed854c5c was updated. But let's keep it for future in case new CVE starts with that again. (From OE-Core rev: 446df2e29495e615dd6d95b158dd37363830cd3e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'documentation/ref-manual')
0 files changed, 0 insertions, 0 deletions