CVE 5.0 converter

[oliverchang]

We should implement a CVE 5.0 converter to/from OSV.

[kurtseifried]

One question: there are some things missing from OSV that the CVE JSON format has, and vice versa, what are the plans for that?

One possible answer: you can embed the entire CVE JSON in the database_specific field so data is not lost and then add support later since the data is there.

[oliverchang]

One question: there are some things missing from OSV that the CVE JSON format has, and vice versa, what are the plans for that?

One possible answer: you can embed the entire CVE JSON in the database_specific field so data is not lost and then add support later since the data is there.

Yep indeed! database_specific is what this is for. CVE JSON also has a lot of stuff that I'm not sure we'd want to include in OSV -- we want OSV to remain simple and easily understandable for open source. A lot of the extra things in CVE come from the fact that they need to describe vulnerabilities in closed source as well.

[andrewpollock]

Stashing #109 (comment) here to keep things together.

[andrewpollock]

Related: CVEProject/cve-schema#241

[andrewpollock]

Drive by comment:

One possible answer: you can embed the entire CVE JSON in the database_specific field so data is not lost and then add support later since the data is there.

This seems like an unnecessary duplication:

1. the source of truth record in the CVEList should remain around ~forever
2. the source of truth record could evolve independently, and should be consulted for any future repeat conversion attempts