drop 'defects', 'advisory id' and 'Source of vulnerability discovery' fields?

[raboof]

They seem to be rarely filled and distract from the main data elements

[iamamoose]

are any of these required by CNA CVE rules? Doesn't Tomcat and HTTPD use advisory-id?