I have a question that I don't know if I'm supposed to post it in Ask Ubuntu as it is mostly about Canonical's websites.

The question follows:

I ran a vulnerability detection scan on some Ubuntu servers. In the scan results I saw references to both: https://usn.ubuntu.com/usn/ and https://people.canonical.com/~ubuntu-security/cve/. These sites are both by Canonical and about Ubuntu, however they refer to related packages differently.

To be specific: They use package nomenclature differently. In a USN page they refer to specific packages by it's name in apt and dpkg as well as it's common name but in the CVE tracker that is not the case.

For example:

https://usn.ubuntu.com/usn/usn-3536-1/[enter link description here]3 refers to "libc6" (as well as "eglibc") whereas in the CVE Tracker page it links to, and is linked from https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-1000001.html refers to "eglibc", "glibc", "dietlibc", and "musl". "musl" isn't mentioned in any USN page linked by the CVE tracker page. I realize the one CVE can be related to several USNs and vice versa.

Why do it this way? It seems confusing. Is it just a choice or is there a reason behind it? And more generally what is the relation between a USN and a CVE, and how are USNs determined?