version range defined in CVE JSON 5.0

[Feng Cao <feng.cao@oracle.com>]

Dear members,

We had a short discussion about product version range and how CVE JSON covers it in our last meeting.

I took a look into the latest CVE JSON 5.0 schema (https://github.com/CVEProject/cve-schema/blob/master/schema/v5.0/CVE_JSON_5.0_schema.json). Two simple cases for version range are covered as an optional way:

                        "oneOf": [
                            {
                                "required": ["version", "status"],
                                "maxProperties": 2
                            },
                            {
                                "required": ["version", "status", "versionType"],
                                "oneOf": [
                                    {"required": ["lessThan"]},
                                    {"required": ["lessThanOrEqual"]}
                                ]
                            }

Ideally, it would be great that the version info defined in CSAF and CVE JSON 5.0 would be the same. But the diversion will happen if "product_version_range" is used in CSAF.

On a positive note, "product_status" in CSAF has more categories than "status" in CVE JSON 5.0, which allows CSAF to provide more value.

Thanks,

--Feng

--Feng