Content of glibc advisories vs. CVE JSON v5 and CNA rules?

[Carlos O'Donell <carlos@redhat.com>]

I want to make it as easy as a cut-and-paste to complete the work of
publishing the CVE data when the advisory text is complete.

When the glibc security team publishes an advisory as part of CNA process
we must comply with the CNA Rules and our goal is to use CVE JSONv5 format
uploads.

The JSONv5 format has a title and description field that must be provided.

The most interesting part is that the CVE description has some explicit
requirements in [1] that mean we would adopt similar requirements for
the text of our own advisories.

My opinion is as follows:

- The first line of our advisories should be the CVE title.
- The descriptive text of the advisory should be the CVE description.
  - Note the rules say "8.2.6 MAY contain information not listed here."
    so we can provide whatever else we want.

Thoughts?

-- 
Cheers,
Carlos.

[1] https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_8-2_cve_record_prose_description_requirements