Re: HP's policy on CVE assignments

• To: CVE Editorial Board <cve-editorial-board-list@lists.mitre.org>
• Subject: Re: HP's policy on CVE assignments
• From: jericho <jericho@attrition.org>
• Date: Mon, 10 Apr 2017 21:59:35 -0500
• Authentication-results: spf=none (sender IP is 129.83.29.3) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=attrition.org;
• Delivery-date: Tue Apr 11 08:05:29 2017
• Importance: high
• In-reply-to: <alpine.LNX.2.00.1704071412390.19881@forced.attrition.org>
• List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
• List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
• List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
• List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
• References: <alpine.LNX.2.00.1704071412390.19881@forced.attrition.org>
• Sender: <owner-cve-editorial-board-list@lists.mitre.org>
• Spamdiagnosticmetadata: 6cdb8bfc89744bd8bfee511e3e65aa05
• Spamdiagnosticoutput: 1:2
• User-agent: Alpine 2.00 (LNX 1167 2008-08-23)

Can MITRE weigh in on this please? Pretty significant stance for a CNA 
to 
take, saying they will selective assign based on how a solution is 
delivered. I feel this goes against the spirit and purpose of CVE.

On Fri, 7 Apr 2017, jericho wrote:

: Caught this via Twitter. Thoughts?
: 
: https://twitter.com/tombkeeper/status/850275006256787456
: 

• Follow-Ups:
  • Re: HP's policy on CVE assignments
    • From: "Adinolfi, Daniel R" <dadinolfi@mitre.org>

• References:
  • HP's policy on CVE assignments
    • From: jericho <jericho@attrition.org>

• Prev by Date: Re: HP's policy on CVE assignments
• Next by Date: Re: HP's policy on CVE assignments
• Previous by thread: Re: HP's policy on CVE assignments
• Next by thread: Re: HP's policy on CVE assignments
• Index(es):
  • Date
  • Thread