Naming, and other differences between Canonical's USN pages, and CVE tracker pages

Question

I have a question that I don't know if I'm supposed to post it in Ask Ubuntu as it is mostly about Canonical's websites.

The question follows:

I ran a vulnerability detection scan on some Ubuntu servers. In the scan results I saw references to both: https://usn.ubuntu.com/usn/ and https://people.canonical.com/~ubuntu-security/cve/. These sites are both by Canonical and about Ubuntu, however they refer to related packages differently.

To be specific: They use package nomenclature differently. In a USN page they refer to specific packages by it's name in apt and dpkg as well as it's common name but in the CVE tracker that is not the case.

For example:

https://usn.ubuntu.com/usn/usn-3536-1/enter link description here refers to "libc6" (as well as "eglibc") whereas in the CVE Tracker page it links to, and is linked from https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-1000001.html refers to "eglibc", "glibc", "dietlibc", and "musl". "musl" isn't mentioned in any USN page linked by the CVE tracker page. I realize the one CVE can be related to several USNs and vice versa.

Why do it this way? It seems confusing. Is it just a choice or is there a reason behind it? And more generally what is the relation between a USN and a CVE, and how are USNs determined?

Answer 1

I think that you would have better luck specifically reaching out to the Ubuntu Security Team than asking here on Ask Ubuntu. The Ubuntu Security Team who maintains the pages you're asking about are going to be the best way to get the answers you're after.

And while your question is technically related to Ubuntu, the specific naming conventions and such are not within scope - either here on meta or on main Ask Ubuntu site.

---

I did answer you in a prior revision though... here