5.1.0 accepts undefined properties under "affected"

[ElectricNroff]

At the 2023-12-14 TWG meeting, the discussion suggested that, during testing of the 5.1.0 schema, any CVE Record that validated even though the record format was not "intended" would be considered a "loophole."

As far as I know, it was not intended that arbitrary properties be allowed under "affected" in a container, but records with these do validate.

minimal/plausible test case (the CNA uses the arbitrary property version even though it is a misspelling of the intended property versions)

{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-0001",
"assignerOrgId":"b3476cb9-2e3d-41a6-98d0-0f47421a65b6","state":"PUBLISHED"},
"containers":{"cna":{"providerMetadata":{"orgId":"b3476cb9-2e3d-41a6-98d0-0f47421a65b6"},
"affected":[{"vendor":"v","product":"p",
"version":[{"version":"1","status":"affected"}],
"defaultStatus":"affected"}],
"descriptions":[{"lang":"en","value":"d"}],"references":[{"url":"https://a.ai"}]}}}

possible solution:

1. Find the text Name of the organization in the schema.
2. Go up four lines.
3. Insert "additionalProperties":false,

issues on the current CVE List:

• additional property of "cpe"

CVE-2022-1415
CVE-2022-1438
CVE-2022-3466
CVE-2022-3596
CVE-2022-3916
CVE-2022-3962
CVE-2022-4039
CVE-2022-4137
CVE-2022-4244
CVE-2022-4245
CVE-2022-4318
CVE-2023-0118
CVE-2023-0119
CVE-2023-0813
CVE-2023-0833
CVE-2023-0923
CVE-2023-1108
CVE-2023-1260
CVE-2023-1476
CVE-2023-1584
CVE-2023-2422
CVE-2023-2974
CVE-2023-3223
CVE-2023-3347
CVE-2023-3637
CVE-2023-38200
CVE-2023-38201
CVE-2023-3899
CVE-2023-3961
CVE-2023-3971
CVE-2023-3972
CVE-2023-4004
CVE-2023-4065
CVE-2023-4066
CVE-2023-4091
CVE-2023-4128
CVE-2023-4147
CVE-2023-4380
CVE-2023-4456
CVE-2023-4527
CVE-2023-46846
CVE-2023-46847
CVE-2023-46848
CVE-2023-4806
CVE-2023-4813
CVE-2023-4853
CVE-2023-4911
CVE-2023-5157
CVE-2023-5408
CVE-2023-5625

• additional property of "collection_url"

CVE-2022-1970
CVE-2022-3205

[ccoffin]

The above commits fix this issue by adding an additionalProperties false for the product object. This may result in some current CVE Records not validating if they have unexpected properties within affected/product. I went ahead and added additionalProperties to the bundled schemas as well since it is an easy addition.