espressif/mbedtls
1
0
Fork 0
mirror of https://github.com/espressif/mbedtls.git synced 2026-08-17 16:59:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(sbom): add trustedfirmware CPE for the NVD vendor split

Browse Source 
NVD files Mbed TLS and TF-PSA-Crypto CVEs under two vendor CPEs: the
legacy `arm` and the current `trustedfirmware`. Mbed TLS moved from Arm
to the TrustedFirmware.org project in 2020, and NVD created the
`trustedfirmware:*` CPE entries on 2026-06-05 and has since been
assigning CVEs to both vendors. A manifest carrying only the `arm` CPE
therefore misses CVEs filed solely under `trustedfirmware`.

Add the `trustedfirmware` CPE alongside the existing `arm` CPE in both
the mbed_tls and tf-psa-crypto manifests so both vendors are checked.

Signed-off-by: Frantisek Hrbata <[email protected]>
This commit is contained in:
Frantisek Hrbata
2026-07-09 15:39:54 +08:00
committed by Ashish Sharma
parent a02632a4f2
commit f78df77d48
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sbom.yml
+3 -1
View File
@@ -1,5 +1,7 @@
version: 4.1.0
cpe: cpe:2.3:a:arm:mbed_tls:{}:*:*:*:*:*:*:*
cpe:
- cpe:2.3:a:arm:mbed_tls:{}:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:{}:*:*:*:*:*:*:*
supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
originator: 'Organization: Trusted Firmware <[email protected]>'
description: An open source, portable, easy to use, readable and flexible SSL library with additional features and patches from Espressif.
tf-psa-crypto/sbom.yml
+3 -1
View File
@@ -1,5 +1,7 @@
version: 1.1.0
cpe: cpe:2.3:a:arm:tf-psa-crypto:{}:*:*:*:*:*:*:*
cpe:
- cpe:2.3:a:arm:tf-psa-crypto:{}:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:tf-psa-crypto:{}:*:*:*:*:*:*:*
supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
originator: 'Organization: Trusted Firmware <[email protected]>'
description: An implementation of the PSA Cryptography API maintained under the Mbed TLS project.