From e1a7a4813e233a920c40943f8e041a4fdcef8541 Mon Sep 17 00:00:00 2001 From: Frantisek Hrbata Date: Sat, 19 Jul 2025 18:26:07 +0200 Subject: [PATCH] change: update the SBOM manifest file with keywords and excluded CVEs. The latest version of esp-idf-sbom will enable an extended keyword scan, which can aid in early detection of potential vulnerabilities by matching specified keywords in CVE descriptions. Additionally, CVEs identified by the extended scan but not yet analyzed by the NVD have been added to the CVE exclude list. These CVEs have already been addressed in the current or earlier versions of mbedtls. Signed-off-by: Frantisek Hrbata --- sbom.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sbom.yml b/sbom.yml index 73688c7d5f..9e1090e2ba 100644 --- a/sbom.yml +++ b/sbom.yml @@ -3,3 +3,11 @@ cpe: cpe:2.3:a:arm:mbed_tls:{}:*:*:*:*:*:*:* supplier: 'Organization: Espressif Systems (Shanghai) CO LTD' originator: 'Organization: Trusted Firmware ' description: An open source, portable, easy to use, readable and flexible SSL library with additional features and patches from Espressif. +cve-keywords: + - mbed tls + - mbedtls +cve-exclude-list: + - cve: CVE-2025-52496 + reason: Fixed in 3.6.4 + - cve: CVE-2025-27810 + reason: Fixed in 3.6.3