Re: CNA Rules Announcement

On 10/11/16 6:46 AM, Booth, Harold (Fed) wrote:
> [HB] I assume you are referring to the submission of CVRF into OASIS, and the upcoming revision of it.

Yes.

> The CVRF revision going into OASIS is specifically focused on creating an advisory format and not a vulnerability format. Personally, I wish it were otherwise, but that was the consensus that was developed during the development of the proposal for the TC. There is still going to be a need for a vulnerability specific format of some sort for exchanging vulnerability information and hopefully the same vocabulary can be used where it is useful to do so.

The phrase 'vulnerability report' as used commonly or in the relevant
ISO standards refers to what is used by finders to describe
vulnerabilities and send it to vendors or users.

The name CVRF implied a limited scope than intended. It was corrected at
the TC submission meeting. 'Advisory' has a more compassing scope: it
can be a vulnerability report, notification about vulnerabilities with
or without fixes, about security relevant but non-vulnerability fixes.
There is nothing in the OASIS proposal that would prevent a researcher
from using CVRF to describe a vulnerability.

As a vendor or a vulnerability finder, the key information I may share
in the proposed CVE Information Format or in CVRF (or the new revision)
are essentially the same. Hence this request not to create a duplicate
format to encode the same content.

> If CVE were to use CVRF then it would be necessary to develop a CVE specific profile that everyone would need to adopt. Also, given the change in tastes and current practice, JSON is or has become the preferred data exchange syntax for many (NVD receives requests for us to implement JSON fairly often) and I think that is something that may need consideration as well, but I would agree that using a common dictionary/taxonomy/ontology to bind multiple formats is a must.

I completely agree that CVRF badly needs a revision - a simplification
rather. The key value in CVRF is providing a dictionary, structure or
mindmap. One should be able to express this in other structured formats
like JSON without sacrificing machine readability. I would personally
prefer a hand editable format similar to the HTTP protocol like syntax
suggested in Appendix B - which should make it easy to embed in email,
web pages, commit messages, change logs etc., removing a huge barrier to
entry for small or open source vendors.

Thanks,
-Chandan

--
Security Incident Response Team
Juniper Networks