Name of Your Organization:
Software in the Public Interest, Inc.
Web Site:
http://www.spi-inc.org/
Compatible Capability:
Debian Security Advisories
Capability home page:
http://www.debian.org/security
1) Product Accessibility <CR_2.4>
Provide a short description of how and where your capability is made available to your customers and the public (required):
Debian is providing CVE names on all Debian Security Advisories where appropriate.
Debian Security Advisories are distributed by the Debian security team to various public security mailing lists, and are available from our website.
4) Map Currency Indication <CR_5.1>
Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):
Debian Advisories contain the latest available CVE names. If the due to security reasons the advisory is released previous to there being a CVE name assigned, advisories published on the website are updated whenever a CVE name is available.
5) Map Currency Update Approach <CR_5.2>
Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):
A periodic check is done by the web development team to determine if the CVE mapping is accurate and current. Automated scripts check against the mapping available for Debian advisories mapped in CVE which are used to determine when a status of a candidate entry is updated.
6) Map Currency Update Time <CR_5.3>
Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):
Users of the Debian GNU/Linux distribution are explained that the CVE update is not guaranteed but the web developer team makes a best effort to keep it current.
7) CVE and Compatibility Documentation<CR_4.1>
Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):
http://www.debian.org/security/cve-compatibility
8) Documentation of Finding Elements Using CVE Names <CR_4.2>
Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):
http://www.debian.org/security/cve-compatibility
http://www.debian.org/security/crossreferences
9) Documentation of Finding CVE Names Using Elements <CR_4.3>
Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):
http://www.debian.org/security/cve-compatibility
http://www.debian.org/security/crossreferences
11) Candidates Versus Entries Indication <CR_6.1>
If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):
12) Candidates Versus Entries Explanation <CR_6.2>
If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):
http://www.debian.org/security/cve-compatibility
13) Candidate to Entry Promotion <CR_6.3>
If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):
http://www.debian.org/security/cve-compatibility
14) Candidate and Entry Search Support <CR_6.4>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):
http://www.debian.org/security/cve-compatibility
15) Search Support for Promoted Candidates <CR_6.5>
If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):
http://www.debian.org/security/cve-compatibility
16) Candidate Mapping Currency Indication <CR_6.6>
If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):
http://www.debian.org/security/cve-compatibility
Type-Specific Capability Questions
26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>
Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):
Find all advisories (in english) that contain 2002 candidates
http://search.debian.org/?q=advisory+%22CAN-2002%22&ps=50&o=1&m=all&g=enFind all advisories (in any language) that include CAN-2002-0001
http://search.debian.org/?q=advisory+%22CAN-2002-0001%22&ps=50&o=1&m=all
27) Online Capability Interface Template Usage <CR_A.4.1.1>
Provide a detailed description of how someone can use your "URL template" to interface to your capability's search function (recommended):
Examples:
http://www.example.com/cgi-bin/db-search.cgi?cvename=CVE-YYYY-NNNN
http://www.example.com/cve/CVE-YYYY-NNNN.htmlExamples:
http://www.example.com/cgi-bin/db-search.cgi?cvename=CVE-YYYY-NNNN
http://www.example.com/cve/CVE-YYYY-NNNN.htmlhttp://search.debian.org/?q=advisory+%22CAN-YYYY-NNNN%22&ps=50&o=1&m=all
28) Online Capability CGI Get Method Support <CR_A.4.1.2>
If the URL template is for a CGI program, does it support the HTTP "GET" method? (recommended):
Yes
29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>
Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):
http://www.debian.org/security/2002/dsa-096
31) Electronic Document Format Info <CR_B.3.1>
Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):
All the CVE-related text is provided both in HTML format in the website (searchable through search.debian.org) and in source WML format in the CVS website cvs.debian.org (not searchable)
33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>
Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):
http://www.debian.org/security/2002/dsa-096
http://www.debian.org/security/crossreferences
34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>
Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):
Find all advisories (in english) that contain 2002 candidates
http://search.debian.org/?q=advisory+%22CAN-2002%22&ps=50&o=1&m=all&g=enFind all advisories (in any language) that include CAN-2002-0001
http://search.debian.org/?q=advisory+%22CAN-2002-0001%22&ps=50&o=1&m=all
35) GUI Element to CVE Name Mapping <CR_B.4.2>
Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):
The header of the security advisories which includes CVE Names. A full mapping of CVE names is available at:
http://www.debian.org/security/crossreferences
37) Statement of Compatibility <CR_2.7>
Have an authorized individual sign and date the following Compatibility Statement (required):
"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."
Name: Javier Fernandez-Sanguino
Title: Debian Developer
38) Statement of Accuracy <CR_3.4>
Have an authorized individual sign and date the following accuracy Statement (recommended):
"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."
Name: Javier Fernandez-Sanguino
Title: Debian Developer
