Re: CVE-CNA JSON Format Proposal

[Mark J Cox <mjc@redhat.com>]

> > On 3/21/17 9:36 AM, Booth, Harold (Fed) wrote:
> > > The working group is proposing that the format available at
> > > https://github.com/CVEProject/automation-working-group/blob/
> > master/cve_json_schema/DRAFT-JSON-file-format-v4.md
> > > be used as the structured format for CNAs to submit CVE information
> > > effective as soon as the this recommendation has been accepted by the
> > board.

I did a quick parse of the OpenSSL xml data to see how close we are to be 
able to automatically create the right format.  Output for CVE-2017-3731 
attached.  But is this right or close enough?  It's not clear yet if

* ID or CVE_ID (docs have both)
* if version_data is okay when listing all affected versions
* if the unicode encoding of the original utf-8 credit worked out okay
* may need to parse the description to remove the \n's
* how to define the namespace of the impact word (i.e. this is "moderate" 
by (url defining what moderate means to this vendor)

Cheers, Mark

Attachment: openssl-CVE-2017-3731.json
Description: application/json