You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
redhat-SADP container restates the Red Hat CNA container's descriptions and metrics in same-org records
Summary
In CVE records where Red Hat is both the assigning CNA (CVE Numbering Authority) and the SADP (Supplier ADP) enrichment source, the redhat-SADP container restates the substantive content of Red Hat's own CNA container. The descriptions and metrics are near-verbatim copies. This adds a second copy of the same content that must be kept consistent, and it is not always consistent (see companion contradiction issue #15).
Scope: this affects only the same-org records (Red Hat as both CNA and supplier), 110 of 1,164 records in the snapshot below. For the roughly 90% of records where Red Hat is not the CNA, the SADP container is additive (downstream RHEL applicability, CPEs, and RHSA errata that the upstream CNA does not provide) and this issue does not apply.
Evidence: restatement across the 110 same-org records
Field
Identical between CNA and SADP containers
descriptions
110/110
metrics
109/110
descriptions and metrics both identical
109/110
title (ignoring letter case)
110/110
The SADP container is not a byte-for-byte duplicate. Two things differ: title letter-casing (in all 110), and references. In 43 of the 110 records the SADP container adds references the CNA container does not carry, so the container is not pure duplication. The redundancy is specifically in the substantive descriptions and metrics content.
Footprint: the identical descriptions and metrics content accounts for roughly 113 KB, about 19% of the roughly 592 KB of JSON across the 110 same-org SADP containers (measured as the serialized length of the identical field values, snapshot below).
I understand ADP containers are intended to be independently consumable, so some restatement is by design. The observation is narrower: in the same-org case, the descriptions and metrics restatement carries no content the CNA container does not already assert, while creating a second copy that has to stay in sync. Companion issue #15 shows that copy has already diverged in 21 records.
Suggested fix
Treat this together with the precedence rule proposed in companion contradiction issue #15. If the pilot defines the CNA container as authoritative for same-org records, then restating its descriptions and metrics in the supplier ADP container is optional and could be reduced to the fields the supplier actually adds (for example the extra references). This is offered as an option, since it trades away some of the independently-consumable property of ADP containers, and may not fit the pilot's design goals.
Snapshot and reproducibility
CVE records retrieved from GET https://cveawg.mitre.org/api/cve/{id} on 2026-07-01 (UTC).
SADP corpus (the set of redhat-SADP CVE IDs) taken from RogoLabs/SADP-Tracker at commit c000694. Data source for that corpus is CVEProject/sadp-pilot.
CNA identity matched on providerMetadata.orgId, not name. Red Hat CNA org is 53f830b8-0a3f-465b-8143-3b8a9948e749; the redhat-SADP supplier org is 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (a distinct org identity).
CVE records are living documents, so absolute counts may drift on later pulls.
The full list of 110 same-org CVE IDs is available on request.
redhat-SADP container restates the Red Hat CNA container's descriptions and metrics in same-org records
Summary
In CVE records where Red Hat is both the assigning CNA (CVE Numbering Authority) and the SADP (Supplier ADP) enrichment source, the
redhat-SADPcontainer restates the substantive content of Red Hat's own CNA container. Thedescriptionsandmetricsare near-verbatim copies. This adds a second copy of the same content that must be kept consistent, and it is not always consistent (see companion contradiction issue #15).Scope: this affects only the same-org records (Red Hat as both CNA and supplier), 110 of 1,164 records in the snapshot below. For the roughly 90% of records where Red Hat is not the CNA, the SADP container is additive (downstream RHEL applicability, CPEs, and RHSA errata that the upstream CNA does not provide) and this issue does not apply.
Evidence: restatement across the 110 same-org records
descriptionsmetricsdescriptionsandmetricsboth identicaltitle(ignoring letter case)The SADP container is not a byte-for-byte duplicate. Two things differ: title letter-casing (in all 110), and
references. In 43 of the 110 records the SADP container addsreferencesthe CNA container does not carry, so the container is not pure duplication. The redundancy is specifically in the substantivedescriptionsandmetricscontent.Footprint: the identical
descriptionsandmetricscontent accounts for roughly 113 KB, about 19% of the roughly 592 KB of JSON across the 110 same-org SADP containers (measured as the serialized length of the identical field values, snapshot below).I understand ADP containers are intended to be independently consumable, so some restatement is by design. The observation is narrower: in the same-org case, the
descriptionsandmetricsrestatement carries no content the CNA container does not already assert, while creating a second copy that has to stay in sync. Companion issue #15 shows that copy has already diverged in 21 records.Suggested fix
Treat this together with the precedence rule proposed in companion contradiction issue #15. If the pilot defines the CNA container as authoritative for same-org records, then restating its
descriptionsandmetricsin the supplier ADP container is optional and could be reduced to the fields the supplier actually adds (for example the extrareferences). This is offered as an option, since it trades away some of the independently-consumable property of ADP containers, and may not fit the pilot's design goals.Snapshot and reproducibility
GET https://cveawg.mitre.org/api/cve/{id}on 2026-07-01 (UTC).redhat-SADPCVE IDs) taken fromRogoLabs/SADP-Trackerat commitc000694. Data source for that corpus isCVEProject/sadp-pilot.providerMetadata.orgId, not name. Red Hat CNA org is53f830b8-0a3f-465b-8143-3b8a9948e749; theredhat-SADPsupplier org is0b0ca135-0b70-47e7-9f44-1890c2a1c46c(a distinct org identity).