[Bug 916770] osc patchinfo generates incorrect cve