Skip to content

Commit ce5f5c8

Browse files
ccoffinccoffin
authored
Merge pull request #464 from CVEProject/5.2.0
5.2.0
2 parents a29f28e + 5533f60 commit ce5f5c8

21 files changed

+1389
-78
lines changed

‎.github/workflows/validate-schema.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@ name: Validate JSON Schemas
22
on:
33
push:
44
branches:
5-
- master
5+
- main
66
pull_request:
77
types: [opened, synchronize, reopened]
88
workflow_dispatch:
99
branches:
10-
- master
10+
- main
1111
env:
1212
CVE_SCHEMA_DIR: schema
1313
CVE_SCHEMA_FILENAME: CVE_Record_Format.json
@@ -22,7 +22,6 @@ jobs:
2222
- name: Install schema2markmap NPM dependencies
2323
run: |
2424
npm --prefix "${CVE_SCHEMA_DIR}/support/schema2markmap" install "${CVE_SCHEMA_DIR}/support/schema2markmap"
25-
# Rename the schema, since AJV doesn't like non-".json" extensions
2625
- name: Prepare schema for bundling
2726
run: |
2827
sed 's/file\://g' "${CVE_SCHEMA_DIR}/${CVE_SCHEMA_FILENAME}" > "${CVE_SCHEMA_DIR}/cve-schema.json"

‎README.md‎

Lines changed: 113 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,113 @@
1-
# Current Version of CVE Record Format
2-
3-
Update to cve-schema to provide better support for CPE!! if you have integrations that rely on the cve-schema repo structure, please review the changes here. The latest version of the CVE JSON Record Format is 5.1.1. A single schema file with bundled dependencies is available [here](https://github.com/CVEProject/cve-schema/blob/master/schema/docs/CVE_Record_Format_bundled.json).
4-
5-
Note: The CVE Record Format now supports Authorized Data Publisher (ADP) containers there is one active ADP currently. The CVE Program uses a separate ADP container to provide additional CVE information (e.g., references) for some records. Access this README.md page [here](
6-
https://github.com/CVEProject/cvelistV5/blob/main/README.md)
7-
for more information about the CVE Program Container.
8-
9-
Note: Please refer to the CVE Services page [here](https://www.cve.org/AllResources/CveServices) for known issues with the schema.
10-
11-
# CVE Record Format Overview
12-
13-
cve-schema specifies the CVE Record Format. This is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit.
14-
15-
### Learn
16-
17-
Learn more about the CVE program at: https://www.cve.org/
18-
19-
This CVE Record Format is defined using JSON Schema. Learn more about JSON Schema at: https://json-schema.org/ .
20-
21-
### Latest
22-
23-
The latest version of the CVE Record Format is 5.1.1. It is specified in the JSON schema at https://github.com/CVEProject/cve-schema/blob/master/schema/CVE_Record_Format.json
24-
25-
A single schema file with bundled dependencies is at https://github.com/CVEProject/cve-schema/blob/master/schema/docs/CVE_Record_Format_bundled.json
26-
27-
### Documentation and Guidance
28-
29-
Documentation about this format is available at https://cveproject.github.io/cve-schema/schema/docs/
30-
31-
A mindmap version of the CVE Record structure is at https://cveproject.github.io/cve-schema/schema/docs/mindmap.html
32-
33-
More details about Product and Version Encodings in the CVE Record Format are at https://github.com/CVEProject/cve-schema/blob/master/schema/docs/versions.md
34-
35-
### Examples
36-
37-
A basic example of a full record in the 5.1.1 format with minimally required fields is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/full-record-basic-example.json
38-
39-
An advanced example of a full record in the 5.1.1 format is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/full-record-advanced-example.json
40-
41-
A basic example of a cnaContainer, to be used with CVE Services, is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/cnaContainer-basic-example.json
42-
43-
An advanced example of a cnaContainer, to be used with CVE Services, is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/cnaContainer-advanced-example.json
1+
# CVE Record Format
2+
3+
![GitHub Tag](https://img.shields.io/github/v/tag/cveproject/cve-schema)
4+
![GitHub License](https://img.shields.io/github/license/cveproject/cve-schema)
5+
6+
The **CVE Record Format** is the [JSON schema][json_schema] defining the
7+
structure of CVE records. It was previously called the "CVE Schema." This
8+
repository is maintained by the [CVE Quality Working Group][qwg] (QWG) under
9+
the [QWG Charter][qwg_charter].
10+
11+
This repository is part of the [CVE Project][cve] and is governed by CVE's
12+
[Professional Code of Conduct][coc].
13+
14+
---
15+
16+
## Read the Record Format
17+
18+
The version of the schema found on the [`main` branch][branch_main] of this
19+
repository is the current production version used by CVE Services. The
20+
development version, which reflects work-in-progress changes planned for future
21+
production versions, is found on the [`develop` branch][branch_develop].
22+
23+
### Production Version
24+
25+
The current production version of the CVE Record Format is available in several
26+
forms:
27+
28+
- [Separate files][fmt_1]
29+
- [Single file][fmt_2]
30+
- [Interactive][fmt_3]
31+
- [Mindmap][fmt_4]
32+
33+
Additionally, the CVE Record Format incorporates mechanisms for encoding
34+
product identity and version information, which are [documented in greater
35+
detail][products_and_versions].
36+
37+
### Development Version
38+
39+
The development version of the CVE Record Format can be found in the
40+
[`develop` branch][branch_develop]:
41+
42+
- [Separate files][fmt_5]
43+
44+
## Examples
45+
46+
- [Example with minimum required fields][ex_1]
47+
- [More complete example][ex_2]
48+
- [A basic example of a `cnaContainer`, to be used with CVE Services][ex_3]
49+
- [An advanced example of a `cnaContainer`, to be used with CVE Services][ex_4]
50+
51+
## Known Issues
52+
53+
The CVE Services page on the CVE site tracks
54+
[known issues with the CVE Record Format][known_issues].
55+
56+
## Contributing
57+
58+
Work in this repository is managed by the CVE [Quality Working Group][qwg]. QWG
59+
meetings are open to CVE authorized program members, including:
60+
61+
- Members of the [CVE Board][cve_board]
62+
- Representatives of [CVE Numbering Authorities (CNAs)][cve_cnas]
63+
- Representatives of [Authorized Data Publishers (ADPs)][cve_adps]
64+
- Participants from the [CVE Secretariat][cve_secretariat] (currently
65+
[The MITRE Corporation][mitre])
66+
67+
On a case-by-case basis, the QWG can invite to participate, through consensus,
68+
individuals who are not CVE program members. To request admission to the QWG,
69+
please contact one of the QWG Co-Chairs, currently
70+
[Chris Coffin (MITRE)][cochair_chris_coffin],
71+
[MegaZone (F5)][cochair_megazone], or
72+
[David Waltermire (GSA FedRAMP)][cochair_dave_waltermire].
73+
74+
Any individual is welcome to participate via [Issues][gh_issues],
75+
[Discussions][gh_discussions], and [Pull Requests][gh_prs], including opening
76+
issues, creating proposals, commenting on existing proposals in Pull
77+
Requests, and asking questions about the Record Format. Decisions on how to
78+
proceed with any proposal are made by the Quality Working Group via consensus.
79+
Final authority for approving or rejecting changes to the CVE Record Format
80+
lies with the [CVE Board][cve_board].
81+
82+
All participation in this project is subject to the rules and procedures of the
83+
[CVE Professional Code of Conduct][coc].
84+
85+
[branch_develop]: https://github.com/CVEProject/cve-schema/tree/develop
86+
[branch_main]: https://github.com/CVEProject/cve-schema/tree/main
87+
[cve]: https://www.cve.org/
88+
[cve_board]: https://www.cve.org/ProgramOrganization/Board
89+
[cve_cnas]: https://www.cve.org/ProgramOrganization/CNAs
90+
[cve_adps]: https://www.cve.org/ProgramOrganization/ADPs
91+
[cve_secretariat]: https://www.cve.org/ResourcesSupport/Glossary?activeTerm=glossarySecretariat
92+
[coc]: https://www.cve.org/ResourcesSupport/AllResources/ProfessionalCodeOfConduct
93+
[cochair_chris_coffin]: https://www.linkedin.com/in/christopher-coffin-1573437/
94+
[cochair_dave_waltermire]: https://www.linkedin.com/in/david-waltermire-024b1710a/
95+
[cochair_megazone]: https://www.linkedin.com/in/megazone/
96+
[ex_1]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/full-record-basic-example.json
97+
[ex_2]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/full-record-advanced-example.json
98+
[ex_3]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/cnaContainer-basic-example.json
99+
[ex_4]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/cnaContainer-advanced-example.json
100+
[fmt_1]: https://github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json
101+
[fmt_2]: https://github.com/CVEProject/cve-schema/blob/main/schema/docs/CVE_Record_Format_bundled.json
102+
[fmt_3]: https://cveproject.github.io/cve-schema/schema/docs/
103+
[fmt_4]: https://cveproject.github.io/cve-schema/schema/docs/mindmap.html
104+
[fmt_5]: https://github.com/CVEProject/cve-schema/blob/develop/schema/CVE_Record_Format.json
105+
[gh_issues]: https://github.com/CVEProject/cve-schema/issues
106+
[gh_discussions]: https://github.com/CVEProject/cve-schema/discussions
107+
[gh_prs]: https://github.com/CVEProject/cve-schema/pulls
108+
[json_schema]: https://json-schema.org/
109+
[known_issues]: https://www.cve.org/AllResources/CveServices
110+
[mitre]: https://www.mitre.org/
111+
[products_and_versions]: https://github.com/CVEProject/cve-schema/blob/main/schema/docs/versions.md
112+
[qwg]: https://github.com/CVEProject/quality-workgroup
113+
[qwg_charter]: https://github.com/CVEProject/quality-workgroup/blob/main/README.md

0 commit comments

Comments
 (0)