Re: source for CVE feed (was: Re: [oss-security] CVE request: httrack buffer overflow)

["Steven M. Christey" <coley () linus mitre org>]

On Mon, 4 Aug 2008, Thijs Kinkhorst wrote:

> Considering your statement we would better be using one of the XML Data feeds
> from http://nvd.nist.gov/download.cfm , right? Or would you recommend another
> feed (e.g. the one where NVD gets its data from)?

NVD's XML data feed is probably the best out there that's publicly
available.  Representatives of CVE-compatible product authors,
vulnerability databases, and software vendors can get direct access to an
email-based feed from MITRE, which is the feed that NVD uses.  MITRE
hasn't opened this to the general public because most people would use it
like a database, and we don't want to compete with other feeds out there.
Guess that's kind of silly these days given that NVD turns it around in 5
minutes, but there it is.

- Steve