vulnerabilities.json endpoint

[bpmcdevitt]

https://openssl-library.org/news/vulnerabilities/

As openSSL is a CNA, it would be great if vulnerabilities can be consumed in a machine-readable format. If there is another source for these vulnerabilities in a format other than the current HTML link above, please let me know.

Can we add in support for a vulnerabilities.json and maybe vulnerabilities.csv endpoint to the main website? Similar to what cURL does.

Here are examples:

• https://curl.se/docs/security.html
• https://curl.se/docs/vuln.json
• https://curl.se/docs/vuln.csv

Thank you. Just wanted to start discussion around this while website is being migrated to new one.

[nhorman]

I think you can get the json format from cve.org, e.g.:
https://cveawg.mitre.org/api/cve/CVE-2023-4807

Or are you looking for something different?

[bpmcdevitt]

Thank you, the MITRE data looks good. It can be that data packed into an array of json objects and hosted at that same https://openssl-library.org/news/vulnerabilities/ endpoint but with https://openssl-library.org/news/vulnerabilities.json
I believe Mozilla does something like this currently: https://www.mozilla.org/en-US/security/advisories/cve-feed.json

another alternative is the previous curl example. That uses the OSV.dev format. For reference: https://ossf.github.io/osv-schema/