oss-sec mailing list archives
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies
From: Art Manion <amanion () cert org>
Date: Fri, 4 Mar 2016 14:08:15 -0500
On 2016-03-04 13:24, Kurt Seifried wrote:
So I've now heard from several security researchers that they are unable to get CVEs for issues that need CVEs (e.g. widely used hardware/software with flaws that have real world impacts and need to be properly tracked. This has definitely resulted in issues being publicized with no CVE that then makes it much harder to track and deal with these issues.
I think it's been said on this list previously -- these are two separate activities: 1. Assigning IDs 2. Analysis, deconfliction, write-up Binding these together results in delay, because #2 takes considerably more calendar time and effort. Another result is a limited but fairly high quality set of entries (once #2 is complete). I share Kurt's concern that CVE is not meeting a researcher/disclosure use case of having IDs for vulnerabilities, and that the community will at some point stop bothering with CVE. I'm not sure how bad such an outcome would be, or what impact that would have on CVE. - Art
Current thread:
- Concerns about CVE coverage shrinking - direct impact to researchers/companies Kurt Seifried (Mar 04)
- Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies Art Manion (Mar 04)
- RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Mike Prosser (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Adam Caudill (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Tim (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Zach W. (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies mark (Mar 05)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Larry Cashdollar (Mar 05)
- RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Mike Prosser (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Alan Coopersmith (Mar 06)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Carlos Alberto Lopez Perez (Mar 09)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Alan Coopersmith (Mar 09)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Carlos Alberto Lopez Perez (Mar 10)
- Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies Art Manion (Mar 04)