CVE fmt: uses YYYY-NNNN format which is wrong: should use CVE-YYYY-NNNN format

[Kees Cook]

When linking or displaying CVEs, Malone needs to make sure the name is correctly shown/parsed as CVE-YYYY-NNNN, so that search engines will be able to make sense of the links. The correct naming convention for CVEs is that they must start with "CVE". Currently, all the links show just YYYY-NNNN.

Other places that would be useful to use the convetion:
- "Link to CVE" page needs to take full CVE name, including "CVE-" prefix
- "CVE Reference" box for bugs that have linked CVEs
- CVE page needs missing dash between "CVE" and index number (e.g. lhttps://bugs.launchpad.net/bugs/cve/2007-2951)
- CVE url paths should be valid with cve prefix too (e.g. https://LP.../bugs/cve/cve-2007-2951

searches need to support CVE-YYYY-NNNN too.

[Diogo Matsubara (matsubara)]

Hi Kees,
I guess you mean the CVE reference box in a bug page, right? Is there any other place that needs updating?
Thanks for the report.

[Kees Cook (kees)]

Correct. As far as I know:

- "Link to CVE" page needs to take full CVE name, including "CVE-" prefix
- "CVE Reference" box for bugs that have linked CVEs
- CVE page needs missing dash between "CVE" and index number (e.g. lhttps://bugs.launchpad.net/bugs/cve/2007-2951)
- CVE url paths should be valid with cve prefix too (e.g. https://LP.../bugs/cve/cve-2007-2951

Really just making the index be "CVE-YYYY-NNNN" instead of "YYYY-NNNNN" should do the trick in most cases.

[Diogo Matsubara (matsubara)]

Kees, thanks for the list. I've udpated the bug description.