Date: Fri, 10 Feb 2017 12:59:16 -0800 From: Seth Arnold <seth.arnold@...onical.com> To: oss-security@...ts.openwall.com Subject: Re: MITRE is adding data intake to its CVE ID process On Fri, Feb 10, 2017 at 03:40:45PM +0000, Priedhorsky, Reid wrote: > I’ve been using the CVE requests on oss-security to maintain a > reasonably comprehensive and timely list of vulnerabilities for specific > products. It’s not clear to me how to do this when CVE requests happen > offline in a web form. > > Has this use case been considered? Is there an alternate way to > accomplish my goal? Another part of the email from MITRE included "When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you." While the oss-security list has been the best resource of information for CVEs for us, part of our CVE ingestion is to download data from NVD and MITRE directly: https://nvd.nist.gov/download https://cve.mitre.org/data/downloads/allitems.xml Debian's database is also very useful to us: https://anonscm.debian.org/viewvc/secure-testing/data/CVE/ And of course our database is freely available as well: https://code.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/master I hope this can help you adapt your processes as MITRE adapts theirs. Thanks Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.