Both the CNA and ADP containers include a source attribute that is defined as:
"source": {
"type": "object",
"description": "This is the source information (who discovered it, who
researched it, etc.) and optionally a chain of CNA information (e.g.
the originating CNA and subsequent parent CNAs who have processed it
before it arrives at the MITRE root).\n Must contain: IF this is in the
root level it MUST contain a CNA_chain entry, IF this source entry is
NOT in the root (e.g. it is part of a vendor statement) then it must
contain at least one type of data entry.",
"minProperties": 1
},
What is the use case for this object? Can we get an example of its intended values? Vulnogram seems to use it to generate:
"source": {
"advisory": "<CNA specific bug tracking IDs>",
"defect": [<CNA specific advisory IDs (Optional)>],
"discovery": "<some value>"
}
but none of that is defined in the schema and the values seem fairly arbitrary (assuming they will remain the same for 5.0).
Both the CNA and ADP containers include a
sourceattribute that is defined as:What is the use case for this object? Can we get an example of its intended values? Vulnogram seems to use it to generate:
but none of that is defined in the schema and the values seem fairly arbitrary (assuming they will remain the same for 5.0).