Commit 5d5971c
tools: update undici CPE in vuln checking script
This changes the search method for `undici` on the NVD database.
Before, since `undici` did not have a CPE assigned, the search
was by keyword. Now that a CPE was assigned, it is used to query
for new vulnerabilities.
PR-URL: #44128
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>1 parent 4ee8ac3 commit 5d5971c
1 file changed
Lines changed: 3 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -47,7 +47,9 @@ def get_cpe(self) -> Optional[str]: | |||
| 47 | 47 | version=vp.get_libuv_version(), cpe=CPE(vendor="libuv_project", product="libuv") | |
| 48 | 48 | ), | |
| 49 | 49 | "undici": Dependency( | |
| 50 | - version=vp.get_undici_version(), cpe=None, keyword="undici", npm_name="undici" | ||
| 50 | + version=vp.get_undici_version(), | ||
| 51 | + cpe=CPE(vendor="nodejs", product="undici"), | ||
| 52 | + npm_name="undici", | ||
| 51 | 53 | ), | |
| 52 | 54 | "OpenSSL": Dependency( | |
| 53 | 55 | version=vp.get_openssl_version(), cpe=CPE(vendor="openssl", product="openssl") | |
0 commit comments