From 9abaa88df92f6ac1b18f177b21377280a6ea1af4 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 20 Jan 2026 09:24:00 +0100 Subject: [PATCH] package/docker-engine: update CPE While `docker:docker` is not marked as deprecated by NVD after a scan through the CVEs the last entry for `docker:docker` is CVE-2022-34883 [1]. Replacing this tuple with `mobyproject:moby` that is referenced in the upstream project GHSA [2]. The last entry for this CPE is CVE-2025-54410 [3]. Note: Quoting [4], "Moby is an open framework created by Docker to assemble specialized container systems without reinventing the wheel". The old github URL [5] redirects to [6]. [1] https://nvd.nist.gov//vuln/detail/CVE-2023-5166 [2] https://github.com/moby/moby/security/advisories [3] https://nvd.nist.gov//vuln/detail/CVE-2025-54410 [4] https://mobyproject.org/ [5] https://github.com/docker/docker [6] https://github.com/moby/moby Signed-off-by: Thomas Perale [Julien: add the note about the Moby project] Signed-off-by: Julien Olivain --- package/docker-engine/docker-engine.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/docker-engine/docker-engine.mk b/package/docker-engine/docker-engine.mk index 37d42edaea..5fe225fbbc 100644 --- a/package/docker-engine/docker-engine.mk +++ b/package/docker-engine/docker-engine.mk @@ -13,8 +13,8 @@ DOCKER_ENGINE_LICENSE_FILES = LICENSE DOCKER_ENGINE_DEPENDENCIES = host-pkgconf libseccomp DOCKER_ENGINE_GOMOD = github.com/docker/docker -DOCKER_ENGINE_CPE_ID_VENDOR = docker -DOCKER_ENGINE_CPE_ID_PRODUCT = docker +DOCKER_ENGINE_CPE_ID_VENDOR = mobyproject +DOCKER_ENGINE_CPE_ID_PRODUCT = moby DOCKER_ENGINE_LDFLAGS = \ -X $(DOCKER_ENGINE_GOMOD)/dockerversion.BuildTime="" \