Feature request: extend the schema to allow tags about security-advisories HOT 6 CLOSED

CVE is already a first-class citizen in the advisory format.

Regarding tags, I'm not sure we need them here (and even more if they are about mixing info about the kind of vulnerability and the community in which they happen).
Tagging vulnerability types might be useful

from security-advisories.

I agree with @stof. Tagging the affected community IMO doesn't make much sense. If you are not part of that community, you shouldn't have that package installed at all in the first place. However, being able to see what kind of vulnerability has been fixed might indeed be valuable information.

from security-advisories.

That seems reasonable.

The initial problem I was trying to solve was to group vulnerabilities together so someone who doesn't use composer in their projects (Magento 1.x, for example, doesn't support it natively) so they could still track the list of vulns that affect their stack. Is there another schema that you would recommend for this?

I'm undecided how I feel about a schema specific to vuln types; a new, limited schema must have a greater justification than a schema less limited in scope. I would currently argue that as it is not a problem I'm currently having, vuln types should not be part of the spec.

I tend to treat vulns as a boolean "should fix", rather than assessing the type.

from security-advisories.

@andrewhowdencom a generic tag system is not useful for tooling built on top of this advisory database, as the tools could not know what these tags are meant to represent

from security-advisories.

The tooling doesn't need to be clever necessarily; just provide a means of grouping vulnerabilities in a that means they're easy to browse. At the moment, there is no way to do this - as a Magento (or Drupal or Wordpress or whatever)

I'm quite happy to find another way to do this
this -- I just can't think of one without extending the schema in some way.

from security-advisories.

I'm going to close this, as it doesn't seem like something that can be resolved at the moment.

from security-advisories.