Quotes of the week

CVE is an external tracking system and as such should be handled external to the project.

In our in-house development we often attribute our fixes to tickets in our ticketing system. But often as not the mapping doesn't hold up here either. The problem is that changelogs and commit messages are for all practical purposes immutable. And any relation from tickets to (possible) changes is dynamic: New ones are encountered afterwards, olders ones are invalidated and sometimes the tickets themselves are duplicates that alread had other (partial) fixes for that problem.
So sure, a bugfix might be based on a bug that was reported elsewhere (be it your ticketing system or someone else's like CVE) but that is purely the "inspiration" for the fix. A real bugfix fixes the code itself and any real explanations about what it fixes are it's own (not some CVE number, not a bug report). Ofcourse any examples given in the original CVE/bugreport you used for "inspiration" can be used in a commit message as evidence why the old behaviour was wrong and the new behaviour is correct.

So the only times you should consider linking back from your bugfix to a ticket system would be to thank it for the insights it gave you to get to get you started on the bug ;-)

Ps.
This is about bugfixes, for features a backreference to the original tracking ticket *is* useful as that information is not dynamic or subject to change afterwards.