CVE published date field available in the report

[stefaniuk]

What would you like to be added:

We would like to request an additional filed(s) to be added to the report produced by grype that would enable us to tell when a CVE has been published and last updated.

Why is this needed:

Currently this information doesn't seem to be available in the JSON output.

Additional context:

This is for the purpose of reporting.

[kzantow]

This looks like a great addition and we'll look to add this to Grype! It looks like we're reading this information from NVD but we would need to update the Grype DB to get it included; we'll add this to the backlog. Thanks for bringing this to our attention!

[kzantow]

Hey @westonsteimel do you have any other thoughts on this?

[wawadevops]

It will be a huge enhancement. Looking forward to this feature.

[matheusfm]

+1

[brianwcook]

+1 - this would make it possible to apply CVE fix SLAs.

[benjaminwilcox]

+1

[rulas]

+1, this is a must-have. Specially to prioritize issues by age.

[ogomezg0106]

Getting to include CVE Published Date from NVD would help a lot in order to automate results report content.

[Noclas]

+1, this would help to work properly with SLAs regarding a given CVE.