Add "severity" to vuln/core JSON vulnerability feed

[srmish-jfrog]

It would be great to include the vulnerability's severity in the JSON files generated under vuln/core.

For example for 146.json -

{
    "cve": [
        "CVE-2024-37372"
    ],
+  "severity": "low",
    "vulnerable": "20.x || 22.x",
    "patched": "^20.15.1 || ^22.4.1",
    "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/",
    "overview": "The Permission Model assumes that any path starting with two backslashes \\\\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.\n\nThis vulnerability affects Windows users of the Node.js Permission Model in version v20.x and v22.x",
    "affectedEnvironments": ["all"]
}

[RafaelGSS]

SGTM. Would you like to update the current database and I'll make sure to update our security release process to include severity for the next ones?

[srmish-jfrog]

Sounds good, I'll create a PR shortly. Note that also index.json would have to be updated each time

[RafaelGSS]

index.json is automatically updated by an action.

[srmish-jfrog]

Ah ok great.
I just noticed that "cve" is a list, so we need a severity for each.
I guess we have two options -
A - Nicer option but breaks the current schema -

{
    "cve":
    [
        {
            "id": "CVE-2020-1234",
            "severity": "low"
        },
        {
            "id": "CVE-2020-5678",
            "severity": "medium"
        }
    ]
}

B - Less nice, but doesn't break the schema -

{
    "cve":
    [
        "CVE-2020-1234",
        "CVE-2020-5678"
    ],
    "severity":
    {
        "CVE-2020-1234": "low",
        "CVE-2020-5678": "medium"
    }
}

What would you prefer?

[RafaelGSS]

cve is a list because sometimes we include a previous CVE to this new vulnerability. Most of the time, they will have the same severity. So, using "severity": "low" should fit for us. In any case, we should always use the highest severity.

[srmish-jfrog]

Gotcha, ok great I will add a single value with the highest severity

[RafaelGSS]

Fixed in #1374