Notice of Pilot Activity in CVE Auto WG - Supporting NVD's Participation

To support NVD's participation in the git pilot, MITRE proposes to add one or two attributes to reference objects in the CVE JSON files in the cvelist repo, which will allow NIST to regenerate the CVE List from the repo rather than having to rely on an older download file (allitems.xml). Specifically, we propose to add the following attributes :

- "source", which represents the source of the reference. It will have one of the values listed at https://cve.mitre.org/data/refs/#sources; eg, "CERT-VN", "CISCO", "CONFIRM", "REDHAT", etc.

- "name", which is a string that helps identify the reference among others in the same source; eg, "VU#584653" (for CERT-CC), "20180104 CPU Side-Channel Information Disclosure Vulnerabilities" (for "CISCO") "RHSA-2018:0292" (for "REDHAT"), etc. Note that, while MITRE uses the reference URL as the name for the "CONFIRM" and "MISC" sources in the CVE List, we plan to omit this attribute for those two sources.

If there are objections from anyone on the Board list, please let us know and we will discuss in the next call. Otherwise, we will proceed with the change and implement early next week

George

--

gtheall@mitre.org

The MITRE Corporation