cannot publish CVE v5 record with vendor, product, collectionURL and packageName

[tatianab]

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked the FAQs on the message board for common solutions: (TBD)
  • Checked that your issue isn't already filed.

Description

Based on my reading of https://github.com/CVEProject/cve-schema/blob/master/schema/v5.0/CVE_JSON_5.0_schema.json,
the fields vendor, product, collectionURL and packageName should all be able to be set within the same affected block. However, when I attempt to publish such a record via CVE Services API, validation fails.

Steps to Reproduce

1. HTTP PUT "https://cveawg.mitre.org/api/cve/CVE-2022-41716/cna" with record https://github.com/golang/vulndb/blob/master/data/cve/v5/GO-2022-1095.json

Expected behavior:

Successful publish

Actual behavior:

Error

400 Bad Request: INVALID_JSON_SCHEMA: CVE cnaContainer JSON schema validation FAILED.
  /cnaContainer/affected/0: must match exactly one schema in oneOf
  /cnaContainer/affected/1: must match exactly one schema in oneOf