The CPE specification was changed causing us to be slightly non-compliant. The CPE names are officially allocated by NIST. Please update spec to replace echo "cpe://o:fedora_project:fedora:%{version}" > $RPM_BUILD_ROOT/etc/system-release-cpe with echo "cpe:/o:fedoraproject:fedora:%{version}" > $RPM_BUILD_ROOT/etc/system-release-cpe (one slash, no underscore) (This doesn't require an errata for existing Fedora releases)
Fixed upstream, will be in next fedora-release drop.