RE: Should be a CVE?

• To: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>, "cve-editorial-board-list@lists.mitre.org" <cve-editorial-board-list@lists.mitre.org>
• Subject: RE: Should be a CVE?
• From: Beverly Finch <beverlyfinch@lenovo.com>
• Date: Tue, 12 Sep 2017 19:37:07 +0000
• Accept-language: en-US
• Authentication-results: spf=none (sender IP is 129.83.29.3) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=fail action=none header.from=lenovo.com;
• Delivery-date: Tue Sep 12 15:57:46 2017
• In-reply-to: <CY4PR09MB14953DFC3F3EB1910B66DEDCF0690@CY4PR09MB1495.namprd09.prod.outlook.com>
• List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
• List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
• List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
• List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
• References: <CY4PR09MB14953DFC3F3EB1910B66DEDCF0690@CY4PR09MB1495.namprd09.prod.outlook.com>
• Sender: <owner-cve-editorial-board-list@lists.mitre.org>
• Spamdiagnosticmetadata: 5952c28dcc454f0789fb433d26f936ef
• Spamdiagnosticoutput: 1:2
• Thread-index: AdMr+xKdVI7ZMURKTvWrOLZub/VO9AAA29Dg
• Thread-topic: Should be a CVE?

I agree.



Regards, 


Beverly M Finch, PMP
PSIRT Program Manager
Product Security Office

7001 Development Drive
Office 3N-C1
Morrisville, NC  27560

+1 919 294 5873
beverlyfinch@lenovo.com



Lenovo.com 
Twitter | Facebook | Instagram | Blogs | Forums






-----Original Message-----
From: owner-cve-editorial-board-list@lists.mitre.org 
[mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of 
Waltermire, David A. (Fed)
Sent: Tuesday, September 12, 2017 3:20 PM
To: cve-editorial-board-list@lists.mitre.org
Subject: Should be a CVE?

Looking at the following, it appears that a CVE was issued for the 
potential that someone might upgrade software to a vulnerable version, 
which has another CVE. I don't think this should qualify as a CVE, 
given the actual vulnerability already has one. 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5698

Should this CVE be rejected?

Regards,
Dave

• Follow-Ups:
  • RE: Should be a CVE?
    • From: "Millar, Thomas" <Thomas.Millar@hq.dhs.gov>

• References:
  • Should be a CVE?
    • From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>

• Prev by Date: Should be a CVE?
• Next by Date: RE: Should be a CVE?
• Previous by thread: Should be a CVE?
• Next by thread: RE: Should be a CVE?
• Index(es):
  • Date
  • Thread