[Question/Discussion] Separate attributes for different CVE states in JSON schema (v5.13)

[mprpic]

Looking at cve513.schema, the root level attributes that contain the actual CVE meta data must be under one of:

• CVE_data_meta_public
• CVE_data_meta_reserved
• CVE_data_meta_reject

Is there a specific reason why the attribute name changes depending on the CVE's state despite the fact that STATE is a property of each of those attributes? This makes it more difficult to parse the JSON and does not really provide any extra value since the state is available as a child property anyway.

Also, is there a reason the REJECT state is not named REJECTED to stay consistent with RESERVED?

[jwhitmore-mitre]

Those 3 names are just reference tags to navigate the schema.
The CVE schema requirements change with the CVE state (PUBLIC, RESERVED, REJECT), If you follow that each of those tags you'll find that they define the content for CVE_data_meta and that they do not create an additional property value. A simplistic interpretation is the value of those properties is substituted the $ref property with their value.
Any JSON produced against this schema should only have the CVE_data_meta property and not the *_public, *_reserved, *_reject reference tags.

[jwhitmore-mitre]

The REJECT state value, we will verify it with the Quality Working Group. And update the schema to match the direction from the QWG.

[mprpic]

Those 3 names are just reference tags to navigate the schema.
The CVE schema requirements change with the CVE state (PUBLIC, RESERVED, REJECT), If you follow that each of those tags you'll find that they define the content for CVE_data_meta and that they do not create an additional property value. A simplistic interpretation is the value of those properties is substituted the $ref property with their value.
Any JSON produced against this schema should only have the CVE_data_meta property and not the *_public, *_reserved, *_reject reference tags.

Ohhh, that makes more sense now. I somehow missed that the top-level attribute name was CVE_data_meta and not the name of the definition being used.

The REJECT state value, we will verify it with the Quality Working Group. And update the schema to match the direction from the QWG.

Ack! Should I rename this issue to reflect that it tracks the decision of the QWG?