oss-security - Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56D9DD1F.1030302@cert.org>
Date: Fri, 4 Mar 2016 14:08:15 -0500
From: Art Manion <amanion@...t.org>
To: Kurt Seifried <kseifried@...hat.com>,
        cve-editorial-board-list <cve-editorial-board-list@...TS.MITRE.ORG>,
        oss-security <oss-security@...ts.openwall.com>
Subject: Re: Concerns about CVE coverage shrinking - direct impact to
 researchers/companies

On 2016-03-04 13:24, Kurt Seifried wrote:
> So I've now heard from several security researchers that they are unable
> to get CVEs for issues that need CVEs (e.g. widely used
> hardware/software with flaws that have real world impacts and need to be
> properly tracked. This has definitely resulted in issues being
> publicized with no CVE that then makes it much harder to track and deal
> with these issues.

I think it's been said on this list previously -- these are two separate
activities:

1. Assigning IDs

2. Analysis, deconfliction, write-up

Binding these together results in delay, because #2 takes considerably
more calendar time and effort.  Another result is a limited but fairly
high quality set of entries (once #2 is complete).

I share Kurt's concern that CVE is not meeting a researcher/disclosure
use case of having IDs for vulnerabilities, and that the community will
at some point stop bothering with CVE.

I'm not sure how bad such an outcome would be, or what impact that would
have on CVE.

 - Art

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.