Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies

[Art Manion <amanion () cert org>]

On 2016-03-05 15:53, Solar Designer wrote:
> ... or on any third-party doing it.  I expect that various existing
> vulnerability databases will start listing OVE IDs along with other IDs
> they're currently listing.  Whatever IDs are available for an issue.
>
> Of course, the information will need to be available to those
> third-party databases from somewhere - but this can be the researcher's
> or the vendor's disclosure, as you say.  Until such disclosure, a
> customer would not even be aware of the ID, let alone want to look it up.

There is a group called VRDX-SIG:

  https://www.first.org/global/sigs/vrdx

An approach we are taking is to develop a simple cross-reference
protocol, such that any vulnerability ID can be related to any other
(e.g., equivalent-to, superset, subset, similar-to, not-equivalent).
This approach was chosen intentionally to avoid creating yet another
CVE-like system, but to support the expected fracturing of vulnerability
ID systems.

 - Art