Skip to content

Commit fc18614

Browse files
alilleybrinkeralilleybrinker
committed
fix: update examples, correct mistaken timestamp regex
Signed-off-by: Andrew Lilley Brinker <abrinker@mitre.org>
1 parent a6382bf commit fc18614

12 files changed

+237
-75
lines changed

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11

22
package-lock.json
33
node_modules
4+
schema/cve-schema.json
5+
schema/docs/CVE_Record_Format_bundled.json
6+
schema/docs/CVE_Record_Format_bundled_adpContainer.json
7+
schema/docs/CVE_Record_Format_bundled_cnaPublishedContainer.json
8+
schema/docs/CVE_Record_Format_bundled_cnaRejectedContainer.json

‎schema/CVE_Record_Format.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@
8585
"timestamp": {
8686
"type": "string",
8787
"description": "Date/time format based on RFC3339 and ISO ISO8601, with a mandatory timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM'.",
88-
"pattern": "^(((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30)))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(Z|[+-][0-9]{2}:[0-9]{2})$",
88+
"pattern": "^(((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30)))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])([+-][0-9]{2}:[0-9]{2})$",
8989
"examples": [
9090
"2025-01-04T12:01:01+05:30"
9191
]

‎schema/docs/CVE_Record_Format_bundled.json‎

Lines changed: 53 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"$schema": "http://json-schema.org/draft-07/schema#",
33
"$id": "https://cveproject.github.io/cve-schema/schema/CVE_Record_Format.json",
44
"title": "CVE JSON record format",
5-
"description": "cve-schema specifies the CVE JSON record format. This is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit. Learn more about the CVE program at [the official website](https://cve.mitre.org). This CVE JSON record format is defined using JSON Schema. Learn more about JSON Schema [here](https://json-schema.org/).",
5+
"description": "The CVE Record Format is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit. Learn more about the CVE program at [the official website](https://www.cve.org). This CVE JSON record format is defined using JSON Schema. Learn more about JSON Schema [here](https://json-schema.org/).",
66
"definitions": {
77
"uriType": {
88
"description": "A universal resource identifier (URI), according to [RFC 3986](https://tools.ietf.org/html/rfc3986).",
@@ -77,6 +77,7 @@
7777
},
7878
"cveId": {
7979
"type": "string",
80+
"description": "The official CVE identifier contains the string 'CVE', followed by the year, followed by a 4 to 19 digit number. Note that the year-part of the identifier should indicate either the year the vulnerability was discovered, or the year the CVE ID is published in. CVE IDs must be unique.",
8081
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
8182
},
8283
"cpe22and23": {
@@ -107,16 +108,13 @@
107108
"minLength": 2,
108109
"maxLength": 32
109110
},
110-
"datestamp": {
111-
"description": "Date/time format based on RFC3339 and ISO ISO8601.",
112-
"type": "string",
113-
"format": "date",
114-
"pattern": "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))$"
115-
},
116111
"timestamp": {
117112
"type": "string",
118-
"description": "Date/time format based on RFC3339 and ISO ISO8601, with an optional timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM'. If timezone offset is not given, GMT (+00:00) is assumed.",
119-
"pattern": "^(((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30)))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})?$"
113+
"description": "Date/time format based on RFC3339 and ISO ISO8601, with a mandatory timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM'.",
114+
"pattern": "^(((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30)))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])([+-][0-9]{2}:[0-9]{2})$",
115+
"examples": [
116+
"2025-01-04T12:01:01+05:30"
117+
]
120118
},
121119
"version": {
122120
"description": "A single version of a product, as expressed in its own version numbering scheme.",
@@ -345,7 +343,7 @@
345343
},
346344
"versions": {
347345
"type": "array",
348-
"description": "Set of product versions or version ranges related to the vulnerability. The versions satisfy the CNA Rules [8.1.2 requirement](https://cve.mitre.org/cve/cna/rules.html#section_8-1_cve_entry_information_requirements). Versions or defaultStatus may be omitted, but not both.",
346+
"description": "Set of product versions or version ranges related to the vulnerability. The versions help satisfy the CNA Rules [5.1.3 requirement](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content). Versions or defaultStatus may be omitted, but not both.",
349347
"minItems": 1,
350348
"uniqueItems": true,
351349
"items": {
@@ -465,7 +463,9 @@
465463
"required": [
466464
"cveId",
467465
"assignerOrgId",
468-
"state"
466+
"state",
467+
"datePublished",
468+
"dateReserved"
469469
],
470470
"properties": {
471471
"cveId": {
@@ -517,7 +517,9 @@
517517
"required": [
518518
"cveId",
519519
"assignerOrgId",
520-
"state"
520+
"state",
521+
"datePublished",
522+
"dateReserved"
521523
],
522524
"properties": {
523525
"cveId": {
@@ -743,7 +745,8 @@
743745
"providerMetadata",
744746
"descriptions",
745747
"affected",
746-
"references"
748+
"references",
749+
"datePublic"
747750
],
748751
"patternProperties": {
749752
"^x_[^.]*$": {}
@@ -924,6 +927,10 @@
924927
],
925928
"additionalProperties": false
926929
}
930+
},
931+
"preformatted": {
932+
"type": "boolean",
933+
"description": "If true, indicates the 'description' is preformatted text that should be rendered to preserve spacing and other formatting. If false, will be rendered without preserving formatting."
927934
}
928935
},
929936
"required": [
@@ -3239,7 +3246,6 @@
32393246
],
32403247
"properties": {
32413248
"time": {
3242-
"description": "Timestamp representing when the event in the timeline occurred. The timestamp format is based on RFC3339 and ISO ISO8601, with an optional timezone. yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM - if the timezone offset is not given, GMT (+00:00) is assumed.",
32433249
"$ref": "#/definitions/timestamp"
32443250
},
32453251
"lang": {
@@ -3305,7 +3311,38 @@
33053311
"source": {
33063312
"type": "object",
33073313
"description": "This is the source information (who discovered it, who researched it, etc.) and optionally a chain of CNA information (e.g. the originating CNA and subsequent parent CNAs who have processed it before it arrives at the MITRE root).\n Must contain: IF this is in the root level it MUST contain a CNA_chain entry, IF this source entry is NOT in the root (e.g. it is part of a vendor statement) then it must contain at least one type of data entry.",
3308-
"minProperties": 1
3314+
"minProperties": 1,
3315+
"properties": {
3316+
"defect": {
3317+
"title": "Defects",
3318+
"type": "array",
3319+
"description": "CNA specific bug or defect tracking IDs (optional).",
3320+
"uniqueItems": true,
3321+
"items": {
3322+
"type": "string",
3323+
"maxLength": 64
3324+
}
3325+
},
3326+
"advisory": {
3327+
"title": "Advisory ID",
3328+
"type": "string",
3329+
"description": "CNA specific advisory IDs (optional).",
3330+
"maxLength": 64
3331+
},
3332+
"discovery": {
3333+
"type": "string",
3334+
"title": "Source of vulnerability discovery",
3335+
"enum": [
3336+
"INTERNAL",
3337+
"EXTERNAL",
3338+
"USER",
3339+
"UPSTREAM",
3340+
"UNKNOWN"
3341+
],
3342+
"description": "Source of vulnerability discovery. This may be a factor for some consumers in prioritizing vulnerability response. \nINTERNAL: this vulnerability was found by the CNA's internal research.\nEXTERNAL: this vulnerability was found during research external to a CNA.\nUSER: This vulnerability was discovered during product use.\nUPSTREAM: This vulnerability was found by an upstream vendor or producer.\nUNKNOWN: Source of discovery is not defined or is unknown",
3343+
"default": "UNKNOWN"
3344+
}
3345+
}
33093346
},
33103347
"language": {
33113348
"type": "string",
@@ -3519,4 +3556,4 @@
35193556
"additionalProperties": false
35203557
}
35213558
]
3522-
}
3559+
}

‎schema/docs/CVE_Record_Format_bundled_adpContainer.json‎

Lines changed: 53 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@
7777
},
7878
"cveId": {
7979
"type": "string",
80+
"description": "The official CVE identifier contains the string 'CVE', followed by the year, followed by a 4 to 19 digit number. Note that the year-part of the identifier should indicate either the year the vulnerability was discovered, or the year the CVE ID is published in. CVE IDs must be unique.",
8081
"pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$"
8182
},
8283
"cpe22and23": {
@@ -107,16 +108,13 @@
107108
"minLength": 2,
108109
"maxLength": 32
109110
},
110-
"datestamp": {
111-
"description": "Date/time format based on RFC3339 and ISO ISO8601.",
112-
"type": "string",
113-
"format": "date",
114-
"pattern": "^((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30))$"
115-
},
116111
"timestamp": {
117112
"type": "string",
118-
"description": "Date/time format based on RFC3339 and ISO ISO8601, with an optional timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM'. If timezone offset is not given, GMT (+00:00) is assumed.",
119-
"pattern": "^(((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30)))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})?$"
113+
"description": "Date/time format based on RFC3339 and ISO ISO8601, with a mandatory timezone in the format 'yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM'.",
114+
"pattern": "^(((2000|2400|2800|(19|2[0-9](0[48]|[2468][048]|[13579][26])))-02-29)|(((19|2[0-9])[0-9]{2})-02-(0[1-9]|1[0-9]|2[0-8]))|(((19|2[0-9])[0-9]{2})-(0[13578]|10|12)-(0[1-9]|[12][0-9]|3[01]))|(((19|2[0-9])[0-9]{2})-(0[469]|11)-(0[1-9]|[12][0-9]|30)))T(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])([+-][0-9]{2}:[0-9]{2})$",
115+
"examples": [
116+
"2025-01-04T12:01:01+05:30"
117+
]
120118
},
121119
"version": {
122120
"description": "A single version of a product, as expressed in its own version numbering scheme.",
@@ -345,7 +343,7 @@
345343
},
346344
"versions": {
347345
"type": "array",
348-
"description": "Set of product versions or version ranges related to the vulnerability. The versions satisfy the CNA Rules [8.1.2 requirement](https://cve.mitre.org/cve/cna/rules.html#section_8-1_cve_entry_information_requirements). Versions or defaultStatus may be omitted, but not both.",
346+
"description": "Set of product versions or version ranges related to the vulnerability. The versions help satisfy the CNA Rules [5.1.3 requirement](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content). Versions or defaultStatus may be omitted, but not both.",
349347
"minItems": 1,
350348
"uniqueItems": true,
351349
"items": {
@@ -465,7 +463,9 @@
465463
"required": [
466464
"cveId",
467465
"assignerOrgId",
468-
"state"
466+
"state",
467+
"datePublished",
468+
"dateReserved"
469469
],
470470
"properties": {
471471
"cveId": {
@@ -517,7 +517,9 @@
517517
"required": [
518518
"cveId",
519519
"assignerOrgId",
520-
"state"
520+
"state",
521+
"datePublished",
522+
"dateReserved"
521523
],
522524
"properties": {
523525
"cveId": {
@@ -743,7 +745,8 @@
743745
"providerMetadata",
744746
"descriptions",
745747
"affected",
746-
"references"
748+
"references",
749+
"datePublic"
747750
],
748751
"patternProperties": {
749752
"^x_[^.]*$": {}
@@ -924,6 +927,10 @@
924927
],
925928
"additionalProperties": false
926929
}
930+
},
931+
"preformatted": {
932+
"type": "boolean",
933+
"description": "If true, indicates the 'description' is preformatted text that should be rendered to preserve spacing and other formatting. If false, will be rendered without preserving formatting."
927934
}
928935
},
929936
"required": [
@@ -3239,7 +3246,6 @@
32393246
],
32403247
"properties": {
32413248
"time": {
3242-
"description": "Timestamp representing when the event in the timeline occurred. The timestamp format is based on RFC3339 and ISO ISO8601, with an optional timezone. yyyy-MM-ddTHH:mm:ss[+-]ZH:ZM - if the timezone offset is not given, GMT (+00:00) is assumed.",
32433249
"$ref": "#/definitions/timestamp"
32443250
},
32453251
"lang": {
@@ -3305,7 +3311,38 @@
33053311
"source": {
33063312
"type": "object",
33073313
"description": "This is the source information (who discovered it, who researched it, etc.) and optionally a chain of CNA information (e.g. the originating CNA and subsequent parent CNAs who have processed it before it arrives at the MITRE root).\n Must contain: IF this is in the root level it MUST contain a CNA_chain entry, IF this source entry is NOT in the root (e.g. it is part of a vendor statement) then it must contain at least one type of data entry.",
3308-
"minProperties": 1
3314+
"minProperties": 1,
3315+
"properties": {
3316+
"defect": {
3317+
"title": "Defects",
3318+
"type": "array",
3319+
"description": "CNA specific bug or defect tracking IDs (optional).",
3320+
"uniqueItems": true,
3321+
"items": {
3322+
"type": "string",
3323+
"maxLength": 64
3324+
}
3325+
},
3326+
"advisory": {
3327+
"title": "Advisory ID",
3328+
"type": "string",
3329+
"description": "CNA specific advisory IDs (optional).",
3330+
"maxLength": 64
3331+
},
3332+
"discovery": {
3333+
"type": "string",
3334+
"title": "Source of vulnerability discovery",
3335+
"enum": [
3336+
"INTERNAL",
3337+
"EXTERNAL",
3338+
"USER",
3339+
"UPSTREAM",
3340+
"UNKNOWN"
3341+
],
3342+
"description": "Source of vulnerability discovery. This may be a factor for some consumers in prioritizing vulnerability response. \nINTERNAL: this vulnerability was found by the CNA's internal research.\nEXTERNAL: this vulnerability was found during research external to a CNA.\nUSER: This vulnerability was discovered during product use.\nUPSTREAM: This vulnerability was found by an upstream vendor or producer.\nUNKNOWN: Source of discovery is not defined or is unknown",
3343+
"default": "UNKNOWN"
3344+
}
3345+
}
33093346
},
33103347
"language": {
33113348
"type": "string",
@@ -3437,10 +3474,11 @@
34373474
}
34383475
}
34393476
},
3477+
"type": "object",
34403478
"properties": {
34413479
"adpContainer": {
34423480
"$ref": "#/definitions/adpContainer"
34433481
}
34443482
},
34453483
"additionalProperties": false
3446-
}
3484+
}

0 commit comments

Comments
 (0)