[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: CVE Current States



This seems perfectly reasonable and I like the idea. What do others think?


In addition, both you and Art Manion had mentioned in a previous thread that we should expand the RESERVED state to cover the different scenarios. We agree and believe that this would help consumers of CVE to better understand the status of a non-populated CVE ID, as opposed to just marking everything as RESERVED. There are a few options for implementing this as was previously pointed out.


-          One option is to split RESERVED into multiple states as was described by Art. RESERVED would be used only for CVE IDs given to CNAs but not yet attached to a vulnerability. The next step would be to create a new state for CVE IDs that are actually attached to a vulnerability, such as ASSIGNED.

-          The other option would be to keep RESERVED as the state, but implement STATE_DETAIL that would include the various stages of a CVE ID. Kurt had mentioned this in the previous thread. The stages would include CNA block allocation and vulnerability assignment. I don’t believe that there would be other STATE_DETAILS beyond these two, but would be interested if others have additional thoughts.




From: Beverly Finch [mailto:beverlyfinch@lenovo.com]
Sent: Thursday, May 25, 2017 8:49 PM
To: Kurt Seifried <kseifried@redhat.com>; Coffin, Chris <ccoffin@mitre.org>
Cc: cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: RE: CVE Current States


I like that.  Will help fine-tune the reporting.







Beverly M Finch, PMP
PSIRT Program Manager

Product Security Office

7001 Development Drive

Office 3N-C1

Morrisville, NC  27560

Phone+1 919 294 5873

Twitter | Facebook | Instagram | Blogs | Forums




From: owner-cve-editorial-board-list@lists.mitre.org [mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of Kurt Seifried
Sent: Thursday, May 25, 2017 9:02 PM
To: Coffin, Chris
Cc: cve-editorial-board-list
Subject: Re: CVE Current States


Currently we have "STATE" in the "CVE_data_meta", can I suggest we add STATE_DETAIL and STATE_DESCRIPTION, e.g.:




"STATE_DESCRIPTION": "it all went horribly wrong"


So basically we'd have to agree on the tags for STATE_DETAIL and then STATE_DESCRIPTION can be free form explanation of what happened for humans.



On Thu, May 25, 2017 at 4:21 PM, Coffin, Chris <ccoffin@mitre.org> wrote:



As discussed in the Board meeting on 5/24, here are the current CVE states along with some descriptions (some exist in the CVE FAQ). In the case of POPULATED and UNASSIGNED, I don’t think we have ever treated these as states in the past, but I think it makes sense to do so for this exercise and moving forward.


UNASSIGNED: A CVE that has never been ALLOCATED or RESERVED. The CVE master list provides an error message in the case that someone attempts to view this CVE ID.

Example: http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2001-10000


RESERVED: A CVE Identifier (CVE ID) is marked as "RESERVED" when it has been reserved for use by a CVE Numbering Authority (CNA) or security researcher, but the details of it are not yet populated.

Example: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1253


REJECT: A CVE ID listed as "REJECT" is a CVE ID that is not accepted as a CVE ID. The reason a CVE ID is marked REJECT will most often be stated in the description of the CVE ID.

Reject reasons (not an inclusive list):

·       Duplicate assignment

·       Duplicate reservation

·       Duplicate Typo in Sequence or year

·       Mixed issues or Dual use

·       Merged (same vuln type/ versions)

·       Withdrawn by CNA (not a vuln)

·       CNA expired pool

Example: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8784


DISPUTED: When one party disagrees with another party's assertion that a particular issue in software is a vulnerability, a CVE ID assigned to that issue may be designated as being "DISPUTED". In these cases, CVE is making no determination as to which party is correct. Instead, we make note of this dispute and try to offer any public references that will better inform those trying to understand the facts of the issue.

Example: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8912


POPULATED: The CVE entry has been published with at least a minimum amount of detail and at least one public reference.

Example: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0002



Chris Coffin

The CVE Team



Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 

Page Last Updated or Reviewed: May 26, 2017