Skip to content

Commit 5e0df50

Browse files
ccoffinccoffin
committed
adding new bundled files
1 parent e4fe53e commit 5e0df50

File tree

4 files changed

+104
-9
lines changed

4 files changed

+104
-9
lines changed

‎schema/docs/CVE_Record_Format_bundled.json‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"$schema": "http://json-schema.org/draft-07/schema#",
33
"$id": "https://cveproject.github.io/cve-schema/schema/CVE_Record_Format.json",
44
"title": "CVE JSON record format",
5-
"description": "cve-schema specifies the CVE JSON record format. This is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit. Learn more about the CVE program at [the official website](https://cve.mitre.org). This CVE JSON record format is defined using JSON Schema. Learn more about JSON Schema [here](https://json-schema.org/).",
5+
"description": "cve-schema specifies the CVE JSON record format. This is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit. Learn more about the CVE program at [the official website](https://www.cve.org). This CVE JSON record format is defined using JSON Schema. Learn more about JSON Schema [here](https://json-schema.org/).",
66
"definitions": {
77
"uriType": {
88
"description": "A universal resource identifier (URI), according to [RFC 3986](https://tools.ietf.org/html/rfc3986).",
@@ -77,6 +77,7 @@
7777
},
7878
"cveId": {
7979
"type": "string",
80+
"description": "The official CVE identifier contains the string 'CVE', followed by the year, followed by a 4 to 19 digit number. Note that the year-part of the identifier should indicate either the year the vulnerability was discovered, or the year the CVE ID is published in. CVE IDs must be unique.",
8081
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
8182
},
8283
"cpe22and23": {
@@ -345,7 +346,7 @@
345346
},
346347
"versions": {
347348
"type": "array",
348-
"description": "Set of product versions or version ranges related to the vulnerability. The versions satisfy the CNA Rules [8.1.2 requirement](https://cve.mitre.org/cve/cna/rules.html#section_8-1_cve_entry_information_requirements). Versions or defaultStatus may be omitted, but not both.",
349+
"description": "Set of product versions or version ranges related to the vulnerability. The versions help satisfy the CNA Rules [5.1.3 requirement](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content). Versions or defaultStatus may be omitted, but not both.",
349350
"minItems": 1,
350351
"uniqueItems": true,
351352
"items": {
@@ -443,6 +444,28 @@
443444
},
444445
"additionalProperties": false
445446
}
447+
},
448+
"packageURL": {
449+
"description": "A Package URL, a unified URL specification for identifying packages hosted by known package hosts. The Package URL MUST NOT include a version.",
450+
"$ref": "#/definitions/uriType",
451+
"examples": [
452+
"pkg:bitbucket/birkenfeld/pygments-main",
453+
"pkg:deb/debian/curl?arch=i386&distro=jessie",
454+
"pkg:docker/cassandra",
455+
"pkg:docker/customer/dockerimage?repository_url=gcr.io",
456+
"pkg:gem/jruby-launcher?platform=java",
457+
"pkg:gem/ruby-advisory-db-check",
458+
"pkg:github/package-url/purl-spec",
459+
"pkg:golang/google.golang.org/genproto#googleapis/api/annotations",
460+
"pkg:maven/org.apache.xmlgraphics/batik-anim?packaging=sources",
461+
"pkg:maven/org.apache.xmlgraphics/batik-anim?repository_url=repo.spring.io/release",
462+
"pkg:npm/%40angular/animation",
463+
"pkg:npm/foobar",
464+
"pkg:nuget/EnterpriseLibrary.Common",
465+
"pkg:pypi/django",
466+
"pkg:rpm/fedora/curl?arch=i386&distro=fedora-25",
467+
"pkg:rpm/opensuse/curl?arch=i386&distro=opensuse-tumbleweed"
468+
]
446469
}
447470
}
448471
},
@@ -3519,4 +3542,4 @@
35193542
"additionalProperties": false
35203543
}
35213544
]
3522-
}
3545+
}

‎schema/docs/CVE_Record_Format_bundled_adpContainer.json‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@
7777
},
7878
"cveId": {
7979
"type": "string",
80+
"description": "The official CVE identifier contains the string 'CVE', followed by the year, followed by a 4 to 19 digit number. Note that the year-part of the identifier should indicate either the year the vulnerability was discovered, or the year the CVE ID is published in. CVE IDs must be unique.",
8081
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
8182
},
8283
"cpe22and23": {
@@ -345,7 +346,7 @@
345346
},
346347
"versions": {
347348
"type": "array",
348-
"description": "Set of product versions or version ranges related to the vulnerability. The versions satisfy the CNA Rules [8.1.2 requirement](https://cve.mitre.org/cve/cna/rules.html#section_8-1_cve_entry_information_requirements). Versions or defaultStatus may be omitted, but not both.",
349+
"description": "Set of product versions or version ranges related to the vulnerability. The versions help satisfy the CNA Rules [5.1.3 requirement](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content). Versions or defaultStatus may be omitted, but not both.",
349350
"minItems": 1,
350351
"uniqueItems": true,
351352
"items": {
@@ -443,6 +444,28 @@
443444
},
444445
"additionalProperties": false
445446
}
447+
},
448+
"packageURL": {
449+
"description": "A Package URL, a unified URL specification for identifying packages hosted by known package hosts. The Package URL MUST NOT include a version.",
450+
"$ref": "#/definitions/uriType",
451+
"examples": [
452+
"pkg:bitbucket/birkenfeld/pygments-main",
453+
"pkg:deb/debian/curl?arch=i386&distro=jessie",
454+
"pkg:docker/cassandra",
455+
"pkg:docker/customer/dockerimage?repository_url=gcr.io",
456+
"pkg:gem/jruby-launcher?platform=java",
457+
"pkg:gem/ruby-advisory-db-check",
458+
"pkg:github/package-url/purl-spec",
459+
"pkg:golang/google.golang.org/genproto#googleapis/api/annotations",
460+
"pkg:maven/org.apache.xmlgraphics/batik-anim?packaging=sources",
461+
"pkg:maven/org.apache.xmlgraphics/batik-anim?repository_url=repo.spring.io/release",
462+
"pkg:npm/%40angular/animation",
463+
"pkg:npm/foobar",
464+
"pkg:nuget/EnterpriseLibrary.Common",
465+
"pkg:pypi/django",
466+
"pkg:rpm/fedora/curl?arch=i386&distro=fedora-25",
467+
"pkg:rpm/opensuse/curl?arch=i386&distro=opensuse-tumbleweed"
468+
]
446469
}
447470
}
448471
},
@@ -3437,10 +3460,11 @@
34373460
}
34383461
}
34393462
},
3463+
"type": "object",
34403464
"properties": {
34413465
"adpContainer": {
34423466
"$ref": "#/definitions/adpContainer"
34433467
}
34443468
},
34453469
"additionalProperties": false
3446-
}
3470+
}

‎schema/docs/CVE_Record_Format_bundled_cnaPublishedContainer.json‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@
7777
},
7878
"cveId": {
7979
"type": "string",
80+
"description": "The official CVE identifier contains the string 'CVE', followed by the year, followed by a 4 to 19 digit number. Note that the year-part of the identifier should indicate either the year the vulnerability was discovered, or the year the CVE ID is published in. CVE IDs must be unique.",
8081
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
8182
},
8283
"cpe22and23": {
@@ -345,7 +346,7 @@
345346
},
346347
"versions": {
347348
"type": "array",
348-
"description": "Set of product versions or version ranges related to the vulnerability. The versions satisfy the CNA Rules [8.1.2 requirement](https://cve.mitre.org/cve/cna/rules.html#section_8-1_cve_entry_information_requirements). Versions or defaultStatus may be omitted, but not both.",
349+
"description": "Set of product versions or version ranges related to the vulnerability. The versions help satisfy the CNA Rules [5.1.3 requirement](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content). Versions or defaultStatus may be omitted, but not both.",
349350
"minItems": 1,
350351
"uniqueItems": true,
351352
"items": {
@@ -443,6 +444,28 @@
443444
},
444445
"additionalProperties": false
445446
}
447+
},
448+
"packageURL": {
449+
"description": "A Package URL, a unified URL specification for identifying packages hosted by known package hosts. The Package URL MUST NOT include a version.",
450+
"$ref": "#/definitions/uriType",
451+
"examples": [
452+
"pkg:bitbucket/birkenfeld/pygments-main",
453+
"pkg:deb/debian/curl?arch=i386&distro=jessie",
454+
"pkg:docker/cassandra",
455+
"pkg:docker/customer/dockerimage?repository_url=gcr.io",
456+
"pkg:gem/jruby-launcher?platform=java",
457+
"pkg:gem/ruby-advisory-db-check",
458+
"pkg:github/package-url/purl-spec",
459+
"pkg:golang/google.golang.org/genproto#googleapis/api/annotations",
460+
"pkg:maven/org.apache.xmlgraphics/batik-anim?packaging=sources",
461+
"pkg:maven/org.apache.xmlgraphics/batik-anim?repository_url=repo.spring.io/release",
462+
"pkg:npm/%40angular/animation",
463+
"pkg:npm/foobar",
464+
"pkg:nuget/EnterpriseLibrary.Common",
465+
"pkg:pypi/django",
466+
"pkg:rpm/fedora/curl?arch=i386&distro=fedora-25",
467+
"pkg:rpm/opensuse/curl?arch=i386&distro=opensuse-tumbleweed"
468+
]
446469
}
447470
}
448471
},
@@ -3437,10 +3460,11 @@
34373460
}
34383461
}
34393462
},
3463+
"type": "object",
34403464
"properties": {
34413465
"cnaContainer": {
34423466
"$ref": "#/definitions/cnaPublishedContainer"
34433467
}
34443468
},
34453469
"additionalProperties": false
3446-
}
3470+
}

‎schema/docs/CVE_Record_Format_bundled_cnaRejectedContainer.json‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@
7777
},
7878
"cveId": {
7979
"type": "string",
80+
"description": "The official CVE identifier contains the string 'CVE', followed by the year, followed by a 4 to 19 digit number. Note that the year-part of the identifier should indicate either the year the vulnerability was discovered, or the year the CVE ID is published in. CVE IDs must be unique.",
8081
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
8182
},
8283
"cpe22and23": {
@@ -345,7 +346,7 @@
345346
},
346347
"versions": {
347348
"type": "array",
348-
"description": "Set of product versions or version ranges related to the vulnerability. The versions satisfy the CNA Rules [8.1.2 requirement](https://cve.mitre.org/cve/cna/rules.html#section_8-1_cve_entry_information_requirements). Versions or defaultStatus may be omitted, but not both.",
349+
"description": "Set of product versions or version ranges related to the vulnerability. The versions help satisfy the CNA Rules [5.1.3 requirement](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content). Versions or defaultStatus may be omitted, but not both.",
349350
"minItems": 1,
350351
"uniqueItems": true,
351352
"items": {
@@ -443,6 +444,28 @@
443444
},
444445
"additionalProperties": false
445446
}
447+
},
448+
"packageURL": {
449+
"description": "A Package URL, a unified URL specification for identifying packages hosted by known package hosts. The Package URL MUST NOT include a version.",
450+
"$ref": "#/definitions/uriType",
451+
"examples": [
452+
"pkg:bitbucket/birkenfeld/pygments-main",
453+
"pkg:deb/debian/curl?arch=i386&distro=jessie",
454+
"pkg:docker/cassandra",
455+
"pkg:docker/customer/dockerimage?repository_url=gcr.io",
456+
"pkg:gem/jruby-launcher?platform=java",
457+
"pkg:gem/ruby-advisory-db-check",
458+
"pkg:github/package-url/purl-spec",
459+
"pkg:golang/google.golang.org/genproto#googleapis/api/annotations",
460+
"pkg:maven/org.apache.xmlgraphics/batik-anim?packaging=sources",
461+
"pkg:maven/org.apache.xmlgraphics/batik-anim?repository_url=repo.spring.io/release",
462+
"pkg:npm/%40angular/animation",
463+
"pkg:npm/foobar",
464+
"pkg:nuget/EnterpriseLibrary.Common",
465+
"pkg:pypi/django",
466+
"pkg:rpm/fedora/curl?arch=i386&distro=fedora-25",
467+
"pkg:rpm/opensuse/curl?arch=i386&distro=opensuse-tumbleweed"
468+
]
446469
}
447470
}
448471
},
@@ -3437,10 +3460,11 @@
34373460
}
34383461
}
34393462
},
3463+
"type": "object",
34403464
"properties": {
34413465
"cnaContainer": {
34423466
"$ref": "#/definitions/cnaRejectedContainer"
34433467
}
34443468
},
34453469
"additionalProperties": false
3446-
}
3470+
}

0 commit comments

Comments
 (0)