Date: Fri, 4 Mar 2016 12:25:57 -0800 From: Mike Prosser <mprosser@...antec.com> To: 'Art Manion' <amanion@...t.org>, Kurt Seifried <kseifried@...hat.com>, cve-editorial-board-list <cve-editorial-board-list@...TS.MITRE.ORG>, oss-security <oss-security@...ts.openwall.com> Subject: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies While it would have an impact for sure on our community, I think the biggest impact would be on customers since CVEs have become a Vulnerability Name when calling support with concerns....rather than just a common tracking reference. -Mike Symantec Software Security Group -----Original Message----- From: owner-cve-editorial-board-list@...ts.mitre.org [mailto:owner-cve-editorial-board-list@...ts.mitre.org] On Behalf Of Art Manion Sent: Friday, March 04, 2016 1:08 PM To: Kurt Seifried <kseifried@...hat.com>; cve-editorial-board-list <cve-editorial-board-list@...TS.MITRE.ORG>; oss-security <oss-security@...ts.openwall.com> Subject: Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies On 2016-03-04 13:24, Kurt Seifried wrote: > So I've now heard from several security researchers that they are > unable to get CVEs for issues that need CVEs (e.g. widely used > hardware/software with flaws that have real world impacts and need to > be properly tracked. This has definitely resulted in issues being > publicized with no CVE that then makes it much harder to track and > deal with these issues. I think it's been said on this list previously -- these are two separate activities: 1. Assigning IDs 2. Analysis, deconfliction, write-up Binding these together results in delay, because #2 takes considerably more calendar time and effort. Another result is a limited but fairly high quality set of entries (once #2 is complete). I share Kurt's concern that CVE is not meeting a researcher/disclosure use case of having IDs for vulnerabilities, and that the community will at some point stop bothering with CVE. I'm not sure how bad such an outcome would be, or what impact that would have on CVE. - Art
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ