Re: [csaf] design "version" in json

Yes. For each type defined, there should be the common cases to
      back it up. I went over many CVEs in NVD, and defined the below
      types in json for the common cases. 

    

    
It is worth noting the below types in json could be classified as
      the break-down of "Known Affected".

    

    
Thanks,

    
--Feng

    

    

    
On 11/29/2018 7:39 AM, Omar Santos
      (osantos) wrote:

    

    
      
      Thank you Feng!
      

      

      
Just a quick question (for the purpose of
        clarification and further discussion from the TC here).

      

      

      
Currently, CSAF/CVRF 1.2 has the following
        "Vulnerability Product Affected Status Type Model"

      
http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html#_Toc493508846Â

      

        
          
First Affected

          
Known Affected

          
Known Not Affected

          
First Fixed

          
Fixed

          
Recommended

          
Last Affected

        
      

      

      

      
Will your suggestion replace or modify those values?
        The reason that I ask is becauseÂÂâfirst affectedâ, âfirst
        fixedâ, and âlast affectedâ could be an overlap of your
        suggestion below.

      

      

      

        

          

            Regards,
            
            
            Omar Santos
            Cisco PSIRT
            Email: 
            PGP Key: 8E19A9D13AF27EDC
            
          

          

            
          

          
        

        

          
            
On Nov 28, 2018, at 7:54 PM, Feng Cao <>
              wrote:

            
            

              

                
Hi CSAF TC,

                
The information about product versions is
                  critical for the users to identify if the products are
                  affected. We had a brief discussion about the
                  possibilities of semantic presentation in today's
                  meeting.
                  
                

                
The below is my proposal to design "version"
                  in json for csaf. The goal is to cover the common use
                  cases. More common cases can be added too if there is
                  a consensus.

                
Thanks,

                
Feng Cao

                
Oracle Security Alerts

                

                

                

                

  ZH-CN
  X-NONE
  
   
   
   
   
   
   
   
   
   
   
  
  MicrosoftInternetExplorer4
  
   
   
   
   
   
   
   
   
   
   
   
  

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
 

                
The
                  list of the common use cases:

                
Â-
                  individual versions

                
For
                  example, CVE-2017-3240, RDBMS Security component of
                  Oracle Database Server, the supported version that is
                  affected is 12.1.0.2

                
Â
                  âversionâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂ âindividualsâ:
                  [

                
ÂÂÂÂ
                  âstrings of versionsâ, âstrings separated by
                  commasâ

                
ÂÂÂÂÂÂ
                  ]

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }

                
-prior
                  to including all the releases

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  For example, CVE-2016-4694, Apache HTTP Server
                  in Apple OS X before 10.12

                
ÂÂ
                  âversionâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpriortoallâ:Â âstring of priortoall versionâ

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                
-prior
                  to including the specified release

                
For
                  example, CVE-2016-6307, OpenSSL 1.1.0 before 1.1.0a

                
ÂÂ
                  âversionâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpriortooneâ:Â [

                
{

                
âbranchâ: âstring of branchâ

                
âreleaseâ: âstring of releaseâ

                
}

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ]

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }ÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                
-internals
                  

                
ÂÂÂÂÂÂÂÂÂÂÂÂ
                  For example, CVE-2016-8740, Apache HTTP Server
                  2.4.17 through 2.4.23 

                
Â
                  âversionâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âintervalâ:Â [

                
{

                
âstartreleaseâ: âstring of releaseâ

                
âendreleaseâ: âstring of releaseâ

                
}

                
]

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }ÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                

                  Â

                
-earlier
                  for all the releases

                
For
                  example, MySQL Enterprise Monitor component of Oracle
                  MySQL (subcomponent: Monitoring: Agent). Supported
                  versions that are affected are 3.1.3.7856 and earlier

                
Â
                  âversionâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âearliertoallâ:Â âstring of releaseâ

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  
                

                
-ealier
                  for the specified release

                
For
                  example, CVE-2016-6307, MySQL Server component of
                  Oracle MySQL (subcomponent: Server: Security:
                  Encryption). Supported versions that are affected are
                  5.6.34 and earlier and 5.7.16 and earlier

                

                  Â

                
Â
                  âversionâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âearliertooneâ:Â [

                
{

                
âbranchâ: âstring of branchâ

                
âreleaseâ: âstring of releaseâ

                
}

                
]

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }

                
Json
                  schema for version inside product:

                
Â"version":{

                

                

                

                

                
ÂÂÂÂÂÂÂÂÂÂÂ ÂÂ
                  âtypeâ:âobjectâ,

                
Â
                  âdescriptionâ: {

                
Âtype: âstringâ

                
ÂÂ
                  },

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpropertiesâ:{

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âindividualsâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ: âarrayâ,

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âitemsâ: { âtypeâ:âstringâ}

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  },

                

                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpriortoallâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ:âstringâ

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  },

                

                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpriortooneâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ: âarrayâ,

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âitemsâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ:âobjectâ,

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpropertiesâ:{

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âbranchâ: {âtypeâ:âstringâ},

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âreleaseâ:{âtypeâ:âstringâ}

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  },

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ârequiredâ:[âbranchâ, âreleaseâ]

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  },

                

                  Â

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âintervalâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ: âarrayâ,

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  Items: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ:âobjectâ,

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpropertiesâ:{

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âstartreleaseâ: {âtypeâ:âstringâ},

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âendreleaseâ: {âtypeâ:âstringâ}

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }, 

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  
                  ârequiredâ:[âstartreleaseâ, âendreleaseâ]

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  },

                

                  Â

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âearliertoallâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ:âstringâ

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  },

                

                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âearliertooneâ: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ: âarrayâ,

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  Items: {

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âtypeâ:âobjectâ,

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âpropertiesâ:{

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âbranchâ: {âtypeâ:âstringâ},

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  âreleaseâ:{âtypeâ:âstringâ}

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  },

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  ârequiredâ:[âbranchâ, âreleaseâ]

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }

                

                  ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  }ÂÂÂÂÂÂÂÂÂÂÂÂÂ
                  

                
}