|
1 | 1 | { |
2 | 2 | "currentNews": [ |
| 3 | + { |
| 4 | + "id": 591, |
| 5 | + "newsType": "blog", |
| 6 | + "title": "CVE Record Format Version 5.2.0 and CVE Services Version 2.6.0 Now Available", |
| 7 | + "urlKeywords": "CVE Record Format CVE Services Updated", |
| 8 | + "date": "2025-10-29", |
| 9 | + "author": { |
| 10 | + "name": "CVE Program", |
| 11 | + "organization": { |
| 12 | + "name": "CVE Program", |
| 13 | + "url": "" |
| 14 | + }, |
| 15 | + "title": "", |
| 16 | + "bio": "" |
| 17 | + }, |
| 18 | + "description": [ |
| 19 | + { |
| 20 | + "contentnewsType": "paragraph", |
| 21 | + "content": "The CVE Program is pleased to announce the release of <a href='https://github.com/CVEProject/cve-schema/blob/master/README.md' target='_blank'>CVE Record Format 5.2.0</a> (view <a href='https://github.com/CVEProject/cve-schema/releases/tag/v5.2.0' target='_blank'>release notes</a>) and <a href='https://github.com/CVEProject/cve-services/releases/tag/v2.6.0' target='_blank'>CVE Services 2.6.0</a> (view <a href='https://github.com/CVEProject/cve-services/releases/tag/v2.6.0' target='_blank'>release notes</a>). This newest version release of the CVE Record Format further enables support the <a href='https://github.com/package-url/' target='_blank'>Package URL (PURL)</a> specification for identifying software packages, components, and libraries in <a href='/ResourcesSupport/Glossary?activeTerm=glossaryRecord'>CVE Records</a>. CVE Services was updated to support this new version of the CVE Record Format." |
| 22 | + }, |
| 23 | + { |
| 24 | + "contentnewsType": "paragraph", |
| 25 | + "content": "Adding PURL support in the new CVE Record Format continues the <a href='/Media/News/item/blog/2024/04/30/New-CVE-Record-Format-Enables-Additional-Data'>evolution of the CVE Record Format</a> to provide additional information of value to the downstream consumer. Being able to quickly correlate vulnerability information with relevant software identification helps accelerate vulnerability management. PURL uses a URL string to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs, and databases." |
| 26 | + }, |
| 27 | + { |
| 28 | + "contentnewsType": "paragraph", |
| 29 | + "content": "<h3>Updates for CVE Record Format 5.2.0</h3>" |
| 30 | + }, |
| 31 | + { |
| 32 | + "contentnewsType": "paragraph", |
| 33 | + "content": "The key updates for the new release include:" |
| 34 | + }, |
| 35 | + { |
| 36 | + "contentnewsType": "paragraph", |
| 37 | + "content": "<ul><li>Support for PURL (Package URL) identifiers using the packageURL property within the affected array items (i.e., product objects).</li><ul><li>Note that adding PURLs to a CVE Record is optional and NOT required for CNAs.</li><li>CVE Services will enforce validation on provided PURL syntax. If any provided PURLs are not syntactically valid according to the <a href='https://github.com/package-url/purl-spec' target='_blank'>PURL specification</a>, the CVE Record will be flagged and will require resubmission after correcting the provided PURL.</li><li>The CVE Record Format will disallow a package version as part of a PURL. The reason is that it could conflict with the version property that is already part of the affected array data. PURLs within the CVE Record Format should NOT include a version.</li></ul><li>Added additionalProperties equal to false for the affected array items. New or renamed properties are no longer allowed for affected array items (i.e., product objects).</li><li>Updates were made to the example CVE Records including PURL examples, tag examples, and a fix to improve compliance with the CNA Rules.</li><li>Multiple documentation and infrastructure improvements were made to better support future CVE Record Format updates.</li></ul>" |
| 38 | + }, |
| 39 | + { |
| 40 | + "contentnewsType": "paragraph", |
| 41 | + "content": "A complete list of updates is available in the <a href='https://github.com/CVEProject/cve-schema/releases/tag/v5.2.0' target='_blank'>release notes</a>." |
| 42 | + }, |
| 43 | + { |
| 44 | + "contentnewsType": "paragraph", |
| 45 | + "content": "<h3>Important Vulnogram Compatibility Update</h3>" |
| 46 | + }, |
| 47 | + { |
| 48 | + "contentnewsType": "paragraph", |
| 49 | + "content": "<a href='https://github.com/Vulnogram/Vulnogram' target='_blank'>Vulnogram</a> is a widely used tool for creating and editing CVE information in CVE JSON format, and for generating advisories. A live instance of <a href='https://vulnogram.github.io/#editor' target='_blank'>Vulnogram</a> is available and can be used immediately for creating and submitting CVE Records, and it was recently updated to allow loading of the new CVE Record Format 5.2.0 Records." |
| 50 | + }, |
| 51 | + { |
| 52 | + "contentnewsType": "paragraph", |
| 53 | + "content": "NOTE: If you have either forked or developed tools based on Vulnogram, you may need to update your code to support loading of 5.2.0 CVE Records." |
| 54 | + }, |
| 55 | + { |
| 56 | + "contentnewsType": "paragraph", |
| 57 | + "content": "You should modify default/cve5/script.js (was line 526 within Vulnogram) so that 5.2 is a valid value. A similar update where the 5.1 support was added can be viewed in a GitHub commit <a href='https://github.com/Vulnogram/Vulnogram/commit/e368607e0768a656270d79dc881850e30935aa7b' target='_blank'>here</a>." |
| 58 | + }, |
| 59 | + { |
| 60 | + "contentnewsType": "paragraph", |
| 61 | + "content": "Replace:<pre>(res && res.dataVersion == \"5.0\" || res.dataVersion == \"5.1\")</pre> with <pre>(res && (res.dataVersion == \"5.0\" || res.dataVersion == \"5.1\" || res.dataVersion == \"5.2\"))</pre>Another alternative would be to replace the code with something that allows all 5.x versions such as: <pre>(res?.dataVersion?.match?.(/^5\\.(0|[1-9][0-9]*)(\\.(0|[1-9][0-9]*))?$/))</pre>" |
| 62 | + }, |
| 63 | + { |
| 64 | + "contentnewsType": "paragraph", |
| 65 | + "content": "<h3>Important Additional Guidance for PURL Support</h3>" |
| 66 | + }, |
| 67 | + { |
| 68 | + "contentnewsType": "paragraph", |
| 69 | + "content": "The CVE Program’s intended use of PURLs is to provide an additional machine-readable identifier for identifying the affected (or unaffected) products within a CVE Record. When included, the provided PURLs should align with the human-readable product and version properties that are already required when producing CVE Records. It is entirely possible that the product names and PURL names will not match up exactly, and this is to be expected. However, <a href='/ProgramOrganization/CNAs'>CVE Numbering Authorities (CNAs)</a> should avoid providing PURLs that do not match up with the human-readable information already provided (and required) within the affected array product and version properties." |
| 70 | + }, |
| 71 | + { |
| 72 | + "contentnewsType": "paragraph", |
| 73 | + "content": "<h3>Updates for CVE Services 2.6.0</h3>" |
| 74 | + }, |
| 75 | + { |
| 76 | + "contentnewsType": "paragraph", |
| 77 | + "content": "<a href='/AllResources/CveServices'>CVE Services</a> will be updated to version 2.6.0 to support the release of CVE Record Format 5.2.0. A complete list of updates will be available in the <a href='https://github.com/CVEProject/cve-services/releases/tag/v2.6.0' target='_blank'>release notes</a>." |
| 78 | + }, |
| 79 | + { |
| 80 | + "contentnewsType": "paragraph", |
| 81 | + "content": "<h3>Detailed Release Notes</h3>" |
| 82 | + }, |
| 83 | + { |
| 84 | + "contentnewsType": "paragraph", |
| 85 | + "content": "For more information on the features, bugs, etc., noted above, and additional compatibility considerations, please see the following on GitHub once they are available:" |
| 86 | + }, |
| 87 | + { |
| 88 | + "contentnewsType": "paragraph", |
| 89 | + "content": "<ul><li><a href='https://github.com/CVEProject/cve-schema/releases/tag/v5.2.0' target='_blank'>CVE Record Format Version 5.2.0 Release Notes</a></li><li><a href='https://github.com/CVEProject/cve-services/releases/tag/v2.6.0' target='_blank'>CVE Services 2.6.0 Release Notes</a></li></ul>" |
| 90 | + }, |
| 91 | + { |
| 92 | + "contentnewsType": "paragraph", |
| 93 | + "content": "<i>Please use the <a target='_blank' href='https://medium.com/@cve_program'>CVE Blog on Medium</a>, or use the <a target='_blank' href='https://cveform.mitre.org/'>CVE Request Web forms</a> and select “Other” from the dropdown menu, to provide feedback about this article." |
| 94 | + } |
| 95 | + ] |
| 96 | + }, |
3 | 97 | { |
4 | 98 | "id": 590, |
5 | 99 | "newsType": "news", |
|
0 commit comments