Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 Mar 2016 09:10:46 +0100
From: Markus Vervier <markus.vervier@...-dsec.de>
To: oss-security@...ts.openwall.com
Subject: Re: Concerns about CVE coverage shrinking - direct
 impact to researchers/companies


On 03/04/2016 07:24 PM, Kurt Seifried wrote:
> So I've now heard from several security researchers that they are
> unable to get CVEs for issues that need CVEs (e.g. widely used
> hardware/software with flaws that have real world impacts and need to
> be properly tracked. This has definitely resulted in issues being
> publicized with no CVE that then makes it much harder to track and
> deal with these issues.
>
Hi,

just in order to second that: We have had similar experience with delays
and with rejections that
seemed random. Especially regarding vulnerabilities that did not fit
into existing vulnerability
classes or would require some amount of work to validate.
It seems to me MITRE currently wants to improve CVE quality but does not
have the resources
to do a real and fair validation.
In my mind having a globally accepted enumeration systems and unique
vulnerability
identifiers is more important than a small curated but outdated list of
selected vulnerabilities.

Therefore I would appreciate to move back to the old process where you
would request a CVE,
get it assigned - but with the possibility of revocation later. Or move
to a fully automated process
like OVE as proposed here before.

Markus

-- 
Markus Vervier (Managing Director)
X41 D-SEC GmbH, Dennewartstr. 25-27, D-52068 Aachen
Unternehmenssitz: Aachen, Amtsgericht Aachen: HRB19989
Geschäftsführer: Markus Vervier 



[ CONTENT OF TYPE application/pkcs7-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ