Add a way for marking a version range as end-of-life

[raschi-de]

I think it would be a good way of communicating that a certain range of versions (e.g. a release branch) is no longer supported and thus will not be fixed, while another one is still in support and fixed.
Vuln mgmt tools could use that to emphasize the need for software maintenance and it would generally support the message that keeping software based environments secure is a shared responsibility across vendors, integrators and users.

This could be implemented e.g. by adding an unsupported-when-assigned tag at the range level.

[zmanion]

unsupported-when-assigned does truly belong to the product element, IIRC it was decided to apply it to the entire CVE record as a starting point.

[raschi-de]

I would argue, the unsupported-when-assigned truly belongs to the version element, not the product element (as you seem to suggest) or the CNA container element (where it currently resides).
It is fairly common that a certain release branch / version range is no longer supported, but the product's latest version branch is supported. For example, OpenSSL is currently in the 3.0.x branch which is fully supported and maintained with new features and all, the version 1.1.1 is still supported for a while but may not receive new features anymore - only bug fixes incl. security, earlier versions are not.

[zmanion]

Yes version is better than product (or container).

[zmanion]

Discussed at the 2024-11-14 QWG meeting. Rough consensus that EoL status should apply to "product" but given the difficulty clearly defining the variety of conditions that indicate EoL and the expected cost/benefit of implementing this, the decision is to not implement this feature.

[ccoffin]

What Art said above... closing