CVE relationships

[ccoffin]

The topic of supporting has come up multiple times in the past. Recent discussions around CVE bundling practices has raised the idea that CVE relationships could potentially reduce the burden of both CVE producers and consumers.

A paper by CVE Board Member Lisa Olson speaks to one possible way of defining CVE relationships. You can find the paper in the QWG groups.io message at https://cve-cwe-programs.groups.io/g/qwg/message/455.

Questions to think about and answer in this discussion:

• Should the CVE Record Format schema support CVE relationships?
• Could the existing taxonomyMappings array be used for defining relationships (https://github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json#L1185)?
• Could tagging be used to identify relationships (https://github.com/ccoffin/cve-schema/blob/main/schema/CVE_Record_Format.json#L1257)?
• Who would benefit from CVE relationships and why, e.g., does it reduce workload of consumer or/and producer?
• What kinds of CVE relationships would be useful, e.g., same vuln type, same patch/fix, same advisory, etc.?
• others? feel free to suggest other questions