From a2a131b62bc85208396fb12a9e12b9846e1146ef Mon Sep 17 00:00:00 2001 From: Frantisek Hrbata Date: Sat, 19 Jul 2025 18:26:07 +0200 Subject: [PATCH] change: update the SBOM manifest file with keywords and excluded CVEs. The latest version of esp-idf-sbom will enable an extended keyword scan, which can aid in early detection of potential vulnerabilities by matching specified keywords in CVE descriptions. Additionally, CVEs identified by the extended scan but not yet analyzed by the NVD have been added to the CVE exclude list. These CVEs have already been addressed in the current or earlier versions of mbedtls. Signed-off-by: Frantisek Hrbata --- sbom.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sbom.yml b/sbom.yml index ddda947e47..e15b1d53e1 100644 --- a/sbom.yml +++ b/sbom.yml @@ -3,3 +3,11 @@ cpe: cpe:2.3:a:arm:mbed_tls:{}:*:*:*:*:*:*:* supplier: 'Organization: Espressif Systems (Shanghai) CO LTD' originator: 'Organization: Trusted Firmware ' description: An open source, portable, easy to use, readable and flexible SSL library with additional features and patches from Espressif. +cve-keywords: + - mbed tls + - mbedtls +cve-exclude-list: + - cve: CVE-2025-52496 + reason: Fixed in 3.6.4 + - cve: CVE-2025-27810 + reason: Fixed in 3.6.3