From 635267f5e392f8622e778b2f15f46b6dd6785e53 Mon Sep 17 00:00:00 2001 From: Frantisek Hrbata Date: Sat, 19 Jul 2025 18:26:07 +0200 Subject: [PATCH] change: update the SBOM manifest file with keywords and excluded CVEs. The latest version of esp-idf-sbom will enable an extended keyword scan, which can aid in early detection of potential vulnerabilities by matching specified keywords in CVE descriptions. Additionally, CVEs identified by the extended scan but not yet analyzed by the NVD have been added to the CVE exclude list. These CVEs have already been addressed in the current or earlier versions of mbedtls. Signed-off-by: Frantisek Hrbata --- sbom.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sbom.yml b/sbom.yml index 1c6f84f51f..9948d5aa61 100644 --- a/sbom.yml +++ b/sbom.yml @@ -3,3 +3,11 @@ cpe: cpe:2.3:a:arm:mbed_tls:{}:*:*:*:*:*:*:* supplier: 'Organization: Espressif Systems (Shanghai) CO LTD' originator: 'Organization: Trusted Firmware ' description: An open source, portable, easy to use, readable and flexible SSL library with additional features and patches from Espressif. +cve-keywords: + - mbed tls + - mbedtls +cve-exclude-list: + - cve: CVE-2025-52496 + reason: Fixed in 3.6.4 + - cve: CVE-2025-27810 + reason: Fixed in 3.6.3