Skip to content

Conversation

@sei-vsarvepalli
Copy link
Contributor

This is an update to SSVC metrics with SSVC 2.0.0 included to support the newer schema's ability to provide contextual information for SSVC metrics. The changes are

  1. Optional CVE ID's in the Selection Schema - so no need to duplicate CVE ID in the metric section
  2. Add Namespace capabilities to provide specific and custom decision points as described by the publisher
  3. Add options References and Decision Tree Resources to be associated to a published metric so there is clarity of SSVC metrics provided
  4. Require Selection to be array of objects that can be iterated with key or value so the data can be minimized if preferred
  5. Timestamp field to allow for Timezone if preferred and still have IETF RFC 3339 fidelity.

@ccoffin ccoffin merged commit fc13951 into CVEProject:feature-144-SSVC Sep 30, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants