[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Information-technology Promotion Agency (JP) using several example CVEs (fwd)

Agreed, whether we like it not, it'll happen. So In general:

CVE-YEAR-1000
CVE-YEAR-10000
CVE-YEAR-100000
CVE-YEAR-1000000
CVE-YEAR-1234
CVE-YEAR-12345
CVE-YEAR-123456
CVE-YEAR-1234567

RESERVED FOR EXAMPLES (ala example.org). 

And then we had discussed using CVE-YEAR-900000 through CVE-YEAR-999999 for testing (e.g. if you see these in the wild it's a test and you can ignore them, unless you're part of the test and want to do whatever with them). 

And that should cover pretty much all the usual cases. 



On Fri, Jun 2, 2017 at 11:03 AM, jericho <jericho@attrition.org> wrote:
Suggestion:

Starting in 2018, reserve common 'example' CVEs like this for a given year to help avoid collisions since the example may be used long before a valid assignment. Hard to predict what people will use as an example, but I would add -1234 and -12345 to this. I've sent several of these types of examples to MITRE in the past. They should be able to generate a more complete list.

.b

---------- Forwarded message ----------
From: jericho <jericho@attrition.org>
To: CVE <cve@mitre.org>
Date: Wed, 17 May 2017 17:04:07 -0500 (CDT)
Subject: Information-technology Promotion Agency (JP) using several example CVEs


FYI

https://www.ipa.go.jp/files/000058610.pdf

Slide 37:

CVE-2017-1000
CVE-2017-10000
CVE-2017-1000000



--
Kurt Seifried
kurt@seifried.org
Page Last Updated or Reviewed: June 02, 2017