oss-sec mailing list archives
Re: MITRE is adding data intake to its CVE ID process
From: Moritz Muehlenhoff <jmm () debian org>
Date: Sat, 11 Feb 2017 10:42:24 +0100
On Fri, Feb 10, 2017 at 04:09:12PM +0000, John Haxby wrote:
On 10/02/17 15:40, Priedhorsky, Reid wrote:To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/> I’ve been using the CVE requests on oss-security to maintain a reasonably comprehensive and timely list of vulnerabilities for specific products. It’s not clear to me how to do this when CVE requests happen offline in a web form. Has this use case been considered? Is there an alternate way to accomplish my goal?I'm glad someone else mentioned this -- I've been wondering too. What would be nice is if the web form forwarded the request and CVE-ID (suitably formatted) to oss-security or a similar list.
For me the value of the oss-security mailing list to have a public mailing list which is read by all the relevant open source security stakeholders. Thats's why we're bringing all non-critical vulnerabilities reported privately to the Debian security team to the attention of this mailing list. Having CVEs assigned is of lesser importance, this was never primarily why we posted security vulnerabilities here. Obtaining CVE IDs caused little overhead on our side, but if that changes (and the announced changes sound like that), then there will simply be less CVE coverage I'm afraid. Cheers, Moritz
Current thread:
- Re: MITRE is adding data intake to its CVE ID process, (continued)
- Re: MITRE is adding data intake to its CVE ID process Simon McVittie (Feb 09)
- Re: MITRE is adding data intake to its CVE ID process Jeremy Stanley (Feb 09)
- Re: MITRE is adding data intake to its CVE ID process Peter Bex (Feb 09)
- Re: MITRE is adding data intake to its CVE ID process Steven R. Loomis (Feb 09)
- Re: MITRE is adding data intake to its CVE ID process Amos Jeffries (Feb 09)
- Re: MITRE is adding data intake to its CVE ID process Jeremy Stanley (Feb 09)
- Re: MITRE is adding data intake to its CVE ID process Simon McVittie (Feb 09)
- Re: MITRE is adding data intake to its CVE ID process John Haxby (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Stiepan (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Simon McVittie (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Pierre Schweitzer (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Moritz Muehlenhoff (Feb 11)
- Re: MITRE is adding data intake to its CVE ID process Bob Friesenhahn (Feb 11)
- RE: MITRE is adding data intake to its CVE ID process Ben Tasker (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mike Gerwitz (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Williams, Ken (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mats Wichmann (Feb 10)