RE: CVE-CNA JSON Format Proposal

• To: "cve-editorial-board-list@lists.mitre.org" <cve-editorial-board-list@LISTS.MITRE.ORG>
• Subject: RE: CVE-CNA JSON Format Proposal
• From: "Booth, Harold (Fed)" <harold.booth@nist.gov>
• Date: Mon, 3 Apr 2017 18:15:15 +0000
• Accept-language: en-US
• Authentication-results: spf=none (sender IP is 129.83.29.2) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=nist.gov;
• Delivery-date: Mon Apr 3 15:30:38 2017
• In-reply-to: <dd9416c4-50fa-79be-2b82-3c83fd532844@cert.org>
• List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
• List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
• List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
• List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
• References: <CY4PR09MB1255F37BD20E03336BDE025AE63D0@CY4PR09MB1255.namprd09.prod.outlook.com> <dd9416c4-50fa-79be-2b82-3c83fd532844@cert.org>
• Sender: <owner-cve-editorial-board-list@lists.mitre.org>
• Spamdiagnosticmetadata: 6cdb8bfc89744bd8bfee511e3e65aa05
• Spamdiagnosticoutput: 1:2
• Thread-index: AdKiRi2B7kRx+mQ9RUypWCI5bCW8bQA/TK8AAlibh+A=
• Thread-topic: CVE-CNA JSON Format Proposal

Art,

  To follow-up on this have your concerns in the ensuing conversation 
been addressed enough? Or what specifically would you like to see in 
order to accept the proposal?

Regards,

-Harold

-----Original Message-----
From: Art Manion [mailto:amanion@cert.org] 
Sent: Wednesday, March 22, 2017 3:35 PM
To: Booth, Harold (Fed) <harold.booth@nist.gov>; 
cve-editorial-board-list@lists.mitre.org
Subject: Re: CVE-CNA JSON Format Proposal

On 3/21/17 9:36 AM, Booth, Harold (Fed) wrote:

> The working group is proposing that the format available at 
> https://github.com/CVEProject/automation-working-group/blob/master/cve
> _json_schema/DRAFT-JSON-file-format-v4.md
> be used as the structured format for CNAs to submit CVE information 
> effective as soon as the this recommendation has been accepted by the 
> board.

I consider my ASSIGNER question to be a non-accepting issue (pending 
further discussion).

A couple other issues that can wait for further revisions:

1. Use of vxref for references in CVE:


https://github.com/FIRSTdotorg/vrdx-sig-vxref-wip/blob/master/vxref/schema/vxref_schema_03.json

2. Assuming CVSS-SIG produces a CVSSv3 JSON spec, include that as an 
extended/optional part of the CVE spec.

 - Art

• Follow-Ups:
  • Re: CVE-CNA JSON Format Proposal
    • From: Art Manion <amanion@cert.org>

• Next by Date: Re: CVE-CNA JSON Format Proposal
• Next by thread: Re: CVE-CNA JSON Format Proposal
• Index(es):
  • Date
  • Thread