CSAF/VEX Schema implementation into CVE JSON 5.0

[PSIRT-JDswann]

I would like to propose that the CVE JSON 5.0 schema implement the CSAF/VEX schema as well. This would make it much easier for vendors that act as CNAs to issue CVEs for their products but also provide vulnerability remediation guidance at the same time the CVE is issues if there is a mitigation or remediation at the time of the CVE publication. Please feel free to email me and I would be happy to discuss further at james.swann@rockwellautomation.com

[zmanion]

I filed #11 for VEX compatibility. I don't think it makes logical sense for CVE to implement CSAF. CSAF is a document/container that can contain one or more vulnerabilities, so CSAF contains one or more CVE IDs.

I think intra- and inter- CVE references are a good idea, but I don't think we're ready to have a CVE within a CVE.