Handling vulnerabilities with multiple CWEs

[achrinza]

Currently CSAF 2.0 only permits a single CWE entry per-vulnerability. This is in contrast to vulnerability databases (e.g. GitHub Advisory Database, OSV) where each entry represents a single vulnerability, of which permits attaching multiple CWEs.

Although #385 clarifies that historically, the CVRF spec did not permit mulitple CWEs on paper, I was not able to find the rationale for the design choice.

In these cases, what would be the best way to represent multiple CWEs for a vulnerability?

Edit:
The CVE Schema GitHub issue for reference: CVEProject/cve-schema#171

[santosomar]

This is a great point. In some cases multiple CWEs could be applied to a single vulnerability. There was no true rationale behind this in CVRF. This could be a good suggestion and enhancement for the next version of CSAF. Thank you 🙏

[tschmidtb51]

I always thought a vulnerability should have only one CWE ("the one that matches best") 🤔
Some additional questions:

• What does CVE allow/require?
• Could somebody provide a real-world example where I would assign more than one CWE?

[rselph-tibco]

CVE allows multiple CWEs under the container's "problemTypes" array.

[santosomar]

Thomas Schmidt proposed a motion, as detailed in this OASIS mailing list archive, to change the schema in CSAF 2.1 to allow multiple CWE entries per vulnerabilities. Stefan Hagen seconded the motion. There were no discussions or objections raised, and consequently, the motion was automatically passed on November 1, 2023, at 20:00 UTC.