Re: MITRE is adding data intake to its CVE ID process

[Guido Berhoerster <guido+openwall.com () berhoerster name>]

* Seth Arnold <seth.arnold () canonical com> [2017-02-10 21:59]:
> On Fri, Feb 10, 2017 at 03:40:45PM +0000, Priedhorsky, Reid wrote:
> > I’ve been using the CVE requests on oss-security to maintain a
> > reasonably comprehensive and timely list of vulnerabilities for specific
> > products. It’s not clear to me how to do this when CVE requests happen
> > offline in a web form.
> >
> > Has this use case been considered? Is there an alternate way to
> > accomplish my goal?
>
> Another part of the email from MITRE included "When you enter a
> vulnerability description on the web form, the CVE and description will
> typically be available on the NVD and CVE web sites at the same time or
> shortly after we email the CVE ID to you."
>
> While the oss-security list has been the best resource of information for
> CVEs for us, part of our CVE ingestion is to download data from NVD and
> MITRE directly:
>
> https://nvd.nist.gov/download
> https://cve.mitre.org/data/downloads/allitems.xml
>
> Debian's database is also very useful to us:
> https://anonscm.debian.org/viewvc/secure-testing/data/CVE/
>
> And of course our database is freely available as well:
> https://code.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/master
>
> I hope this can help you adapt your processes as MITRE adapts theirs.

One significant advantage of monitoring this list was that requests
were immediately visible and there are sometimes significant
delays between a CVE request and the response from MITRE. Or in some
cases requests were rejected with a rationale or did not receive a
response at all -- with the web form such cases will now just
disappear in a black hole.
-- 
Guido Berhoerster