CVEProject / automation-working-group

CVE Automation Working Group
https://www.cve.org/ProgramOrganization/WorkingGroups#AutomationWorkingGroupAWG
160 stars 88 forks source link

Does an ADP content update the date for the CVE record? #117

Closed zmanion closed 8 months ago

zmanion commented 1 year ago

From the 2023-05-03 SPWG meeting, confirm this behavior: changes to an ADP container bump the date on the container, and also bump the date on the CVE record.

If an ADP adds or updates an ADP container frequently, consumers will see lots of updated records. dateUpdated is defined as "The date/time the record was last updated." We probably don't want to redefine this. Semantically, the ADP container is part of the the record, data was updated, so consumers should be made aware by a new date on the record.

Significantly more frequent updates may surprise consumers.

zmanion commented 8 months ago

Moved to https://github.com/CVEProject/cve-schema/issues/293