search

aboutcode-org / vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/
https://public.vulnerablecode.io
Apache License 2.0
528 stars 198 forks source link

Clarify and validate what an Alias can be #861

Open pombredanne opened 2 years ago

pombredanne commented 2 years ago

A vulnerability alias is designed to be strong identifiers. We want to to document and validate what we can use as aliases, such as a CVE prefixed CVE id.

mjherzog commented 1 year ago

There are currently some Aliases from bug tracking systems where the Alias value is just a number. We need to come up with some way to make these Aliases more comprehensible - probably defined at the time that we start collecting such data. Some examples for VCID-9hud-dkbs-aaap are:

For these it might make sense to use Aliases like bugzilla.redhat.com-1930423 and bugs.debian.org-983664.