Include support for SSVC

[justmurphy]

We should include support for SSVC, as discussed in #462 and during July TC meeting.

[justmurphy]

Reasoning:

As referenced in the following blog post from former Executive Assistant Director for Cybersecurity, Eric Goldstein: "Transforming the Vulnerability Management Landscape", CISA believes the integration of Stakeholder-Specific Vulnerability Categorization (SSVC) is crucial for advancing vulnerability management practices across organizations.

SSVC enables organizations to prioritize their remediation efforts effectively by assessing various attributes of vulnerabilities, including exploitation status and technical impact.

We have recently added support for SSVC to our IT advisories seen at CISA's public CSAF repository: https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white/2024

[santosomar]

I completely agree. CSAF should provide support for SSVC. We should also eventually support EPSS.

[sei-vsarvepalli]

I support this effort as well and would like to see SSVC representation available in CSAF. By the way we also have an updated SSVC schema that addresses a number of concerns raised by analysts. The official SSVC schema that we would like to support is here:

https://certcc.github.io/SSVC/data/schema/v1/Decision_Point_Value_Selection-1-0-1.schema.json

An example CVE record with this representation of an SVC evaluation is provided here

https://github.com/CVEProject/cve-schema/blob/1c08e97929e22b1983557fe6ea5a9573831d49db/schema/docs/full-record-advanced-example.json#L134C1-L156C13

[tschmidtb51]

@sei-vsarvepalli Is it possible to update the JSON Schema that to Draft 2020-12?

[ahouseholder]

Connecting some dots here:

• Switch JSON schemas to 2012 support for external merge support.  CERTCC/SSVC#637 covers the specific request in Include support for SSVC #803 (comment)
• CSAF / SSVC integration CERTCC/SSVC#640 is the umbrella issue for CSAF+SSVC integration

[santosomar]

A motion was moved by Omar to include the changes suggested in this pull request, during the CSAF TC monthly meeting on 2024-10-30. The motion was seconded by Michael. The motion passed.

[tschmidtb51]

Todos:

• include in schema
• add in referenced schema
• add link in informative references
• mention in design consideration principles
• add to vulnerability section
• add to guidance on size
• check that link is correct
• add conversion rule
• add tests:
  • id must be consistent with cve (if CVE) or part of ids
  • for known namespaces/version/name, values must match given schema
  • warn on unknown versions for known namespaces/name
  • info on old versions for known namespace/name
  • info for unknown namespaces/name
  • info for unknown role for known namespaces