oss-sec mailing list archives
Re: MITRE is adding data intake to its CVE ID process
From: Tim <tim-security () sentinelchicken org>
Date: Fri, 10 Feb 2017 16:10:24 -0800
Your perception is incorrect.
Actions speak louder than words. Data points: - The fact that so many lesser known researchers couldn't get an ID for so long when they asked for one. - As already discussed, the web form's "Please ensure vendor or product exists in the Products and Sources list". For an open source project, they give up and outsource the process, which then can't be used for obtaining an ID before release. - The most telling though is the entire CNA program, particularly when it allowed only commercial vendors. If a vendor decides something isn't a problem, they can block or slow CVE assignment. It's a corruption of service that ought to be for the public benefit. (And yes, this does happen.) Reporting vulnerabilities in a "responsible" manner is already a huge pain in the ass. Every year getting a CVE is harder and harder, particularly prior to publication (which is how it should be assigned, since the whole point of the CVE is to minimize confusion about which vulnerability we're talking about). tim
Current thread:
- Re: MITRE is adding data intake to its CVE ID process, (continued)
- Re: MITRE is adding data intake to its CVE ID process Bob Friesenhahn (Feb 11)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Ben Tasker (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mike Gerwitz (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Seth Arnold (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Williams, Ken (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mats Wichmann (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Adam Caudill (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Guido Berhoerster (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Solar Designer (Feb 11)
- Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 12)
- Re: MITRE is adding data intake to its CVE ID process Ian Zimmerman (Feb 13)
- Re: MITRE is adding data intake to its CVE ID process Ian Zimmerman (Feb 13)
- Re: Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 13)