oss-sec mailing list archives
Re: MITRE is adding data intake to its CVE ID process
From: Adam Caudill <adam () adamcaudill com>
Date: Fri, 10 Feb 2017 22:44:48 -0500
On Fri, Feb 10, 2017 at 7:10 PM, Tim <tim-security () sentinelchicken org> wrote:
- The fact that so many lesser known researchers couldn't get an ID for so long when they asked for one. - As already discussed, the web form's "Please ensure vendor or product exists in the Products and Sources list". For an open source project, they give up and outsource the process, which then can't be used for obtaining an ID before release.
Once it's completely up and running, DWF should address these issues. Researchers and organizations can easily become CNAs under DWF, with assigned CVE blocks. For OSS, the process of getting a CVE (including pre-publication) should be much simpler than it has been, especially in recent years. It's not quite there yet, but Kurt and team have put a lot of effort into laying the groundwork for a much better solution than the ad-hoc "send an email and hope" process that we've become accustomed to. The old system was far from perfect, as is the interim MITRE web form - hopefully with the help of the community, DWF will be able to provide a better process for all involved. For OSS, DWF is the solution we need to be focused on, and helping it to evolve to suit the needs of everyone.
- The most telling though is the entire CNA program, particularly when it allowed only commercial vendors. If a vendor decides something isn't a problem, they can block or slow CVE assignment. It's a corruption of service that ought to be for the public benefit. (And yes, this does happen.)
While I believe that DWF represents a substantial step forward for OSS, and getting CVEs to those that need them, when they need them; my feelings on CVEs for commercial software remain rather negative. I've stopped requesting CVEs for commercial software due to all of the issues - if I discover something where I believe a CVE is especially important, I direct the request through CERT/CC or another origination. But, this is getting off-topic.
Current thread:
- RE: MITRE is adding data intake to its CVE ID process, (continued)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Ben Tasker (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mike Gerwitz (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Seth Arnold (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Williams, Ken (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mats Wichmann (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Adam Caudill (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Guido Berhoerster (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Solar Designer (Feb 11)
- Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 12)
- Re: MITRE is adding data intake to its CVE ID process Ian Zimmerman (Feb 13)
- Re: MITRE is adding data intake to its CVE ID process Ian Zimmerman (Feb 13)
- Re: Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 13)