Skip to content

Commit 4284ad0

Browse files
Updates from October 2 meeting feedback
1 parent 1fd97f5 commit 4284ad0

File tree

2 files changed

+32
-27
lines changed

2 files changed

+32
-27
lines changed

rfds/0459-SSVC-2-0-0-add.md

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,22 +42,38 @@ This ensures that CVE Records can cleanly incorporate SSVC alongside other struc
4242
The test-cases for PR [#459](https://github.com/CVEProject/cve-schema/pull/459) illustrate how SSVC data can be expressed. For example:
4343

4444
https://certcc.github.io/SSVC/data/schema_examples/CVE-1900-1234-Decision_Point_Value_Selection-2-0-0.json
45-
45+
A minimal record looks like below
4646
```json
4747
{
48-
"target_ids": ["CVE-1900-1234"],
4948
"timestamp": "2021-09-29T15:29:44Z",
5049
"schemaVersion": "2.0.0",
5150
"selections": [
5251
{
5352
"namespace": "ssvc",
54-
"name": "Exploitation",
5553
"key": "E",
5654
"version": "1.1.0",
5755
"values": [
58-
{"name":"Active", "key": "A"}
56+
{"key": "A"}
5957
]
60-
},
58+
}
59+
]
60+
```
61+
62+
A more advanced record looks like below for a similar infomration
63+
64+
```json
65+
{
66+
"timestamp": "2021-09-29T15:29:44Z",
67+
"schemaVersion": "2.0.0",
68+
"selections": [
69+
{
70+
"namespace": "ssvc",
71+
"key": "E",
72+
"version": "1.1.0",
73+
"values": [
74+
{"key": "A"}
75+
]
76+
},
6177
{
6278
"namespace": "ssvc",
6379
"name": "Automatable",
@@ -76,7 +92,15 @@ https://certcc.github.io/SSVC/data/schema_examples/CVE-1900-1234-Decision_Point_
7692
{"name": "Total","key":"T"}
7793
]
7894
}
79-
]
95+
],
96+
"decision_point_resources": [{
97+
"summary": "A JSON file containing SSVC update to Exploitation Decision Point",
98+
"uri": "https://certcc.github.io/SSVC/data/json/decision_points/ssvc/exploitation_1_1_0.json"
99+
}],
100+
"references": [{
101+
"summary": "An exploitation example was published for this vulnerability",
102+
"uri": "https://example.com/report"
103+
}]
80104
}
81105
```
82106

@@ -116,6 +140,7 @@ VulnCheck currently has SSVC coverage for 244,866 CVEs, while CISA Vulnrichment
116140

117141
See: Automating SSVC (VulnCheck blog)[[https://www.vulncheck.com/blog/automating-ssvc]
118142

143+
See: SSVC community which captures usage of SSVC in the real-world at (SSVC Dicssions Sightings)[https://github.com/CERTCC/SSVC/discussions/291]
119144

120145

121146
## Related Issues or Proposals

schema/docs/full-record-advanced-example.json

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -198,35 +198,15 @@
198198
"schemaVersion": "1-0-1"
199199
},
200200
"ssvcV2_0_0":{
201-
"target_ids": ["CVE-1900-1234"],
202201
"timestamp": "2021-09-29T15:29:44Z",
203202
"schemaVersion": "2.0.0",
204203
"selections": [
205204
{
206205
"namespace": "ssvc",
207-
"name": "Exploitation",
208206
"key": "E",
209207
"version": "1.1.0",
210208
"values": [
211-
{"name":"Active", "key": "A"}
212-
]
213-
},
214-
{
215-
"namespace": "ssvc",
216-
"name": "Automatable",
217-
"key": "A",
218-
"version": "2.0.0",
219-
"values": [
220-
{"name": "Yes", "key": "Y"}
221-
]
222-
},
223-
{
224-
"namespace": "ssvc",
225-
"name": "Technical Impact",
226-
"key": "TI",
227-
"version": "1.0.0",
228-
"values": [
229-
{"name": "Total","key":"T"}
209+
{"key": "A"}
230210
]
231211
}
232212
]

0 commit comments

Comments
 (0)