Oss-security mailing list policy change communication

classic Classic list List threaded Threaded
11 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Oss-security mailing list policy change communication

Coffin, Chris

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Oss-security mailing list policy change communication

Landfield, Kent B

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Oss-security mailing list policy change communication

Coffin, Chris

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Oss-security mailing list policy change communication

Landfield, Kent B

Yes, I think this is a bit better.   Do you want OSS-security to always use the MITRE CVE form and then reroute to DWF under the covers? Even after DWF comes on-line?  I guess I should have asked this on the Board call....

 

---

Kent Landfield

+1.817.637.8026

 

From: "Coffin, Chris" <[hidden email]>
Date: Tuesday, January 31, 2017 at 4:48 PM
To: Kent Landfield <[hidden email]>
Cc: cve-editorial-board-list <[hidden email]>
Subject: RE: Oss-security mailing list policy change communication

 

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Oss-security mailing list policy change communication

Coffin, Chris

Kent,

 

How does this look?

 

Chris

 

------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:53 PM
To: Coffin, Chris <[hidden email]>
Cc: cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

Yes, I think this is a bit better.   Do you want OSS-security to always use the MITRE CVE form and then reroute to DWF under the covers? Even after DWF comes on-line?  I guess I should have asked this on the Board call....

 

---

Kent Landfield

+1.817.637.8026

 

From: "Coffin, Chris" <[hidden email]>
Date: Tuesday, January 31, 2017 at 4:48 PM
To: Kent Landfield <
[hidden email]>
Cc: cve-editorial-board-list <
[hidden email]>
Subject: RE: Oss-security mailing list policy change communication

 

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <
[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Oss-security mailing list policy change communication

Landfield, Kent B
Much more informative about what is coming. Thank you.

Kent Landfield
+1.817.637.8026 

On Jan 31, 2017, at 5:20 PM, Coffin, Chris <[hidden email]> wrote:

Kent,

 

How does this look?

 

Chris

 

------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [[hidden email]]
Sent: Tuesday, January 31, 2017 4:53 PM
To: Coffin, Chris <[hidden email]>
Cc: cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

Yes, I think this is a bit better.   Do you want OSS-security to always use the MITRE CVE form and then reroute to DWF under the covers? Even after DWF comes on-line?  I guess I should have asked this on the Board call....

 

---

Kent Landfield

+1.817.637.8026

 

From: "Coffin, Chris" <[hidden email]>
Date: Tuesday, January 31, 2017 at 4:48 PM
To: Kent Landfield <
[hidden email]>
Cc: cve-editorial-board-list <
[hidden email]>
Subject: RE: Oss-security mailing list policy change communication

 

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <
[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Oss-security mailing list policy change communication

kseifried@redhat.com
In reply to this post by Coffin, Chris
"Please note that the DWF is not yet ready to handle volume assignments, however the DWF is actively working towards this in the coming weeks and months."

With any luck we'll have some stuff done for RSA that we can showcase =)

On Tue, Jan 31, 2017 at 3:48 PM, Coffin, Chris <[hidden email]> wrote:

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

<a href="tel:(817)%20637-8026" value="+18176378026" target="_blank">+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 




--

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: [hidden email]
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Oss-security mailing list policy change communication

Coffin, Chris

Kurt,

 

I think the current language states this, with the exception that it does not mention any expected timeframe. Take a look at the following and let me know if you think we should still add this.

 

Chris

 

------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

From: Kurt Seifried [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 6:24 PM
To: Coffin, Chris <[hidden email]>
Cc: Landfield, Kent B <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

"Please note that the DWF is not yet ready to handle volume assignments, however the DWF is actively working towards this in the coming weeks and months."

 

With any luck we'll have some stuff done for RSA that we can showcase =)

 

On Tue, Jan 31, 2017 at 3:48 PM, Coffin, Chris <[hidden email]> wrote:

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

<a href="tel:(817)%20637-8026" target="_blank">+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <
[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 



 

--

 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 
[hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Oss-security mailing list policy change communication

kseifried@redhat.com
yeah I just wanna be super explicit, plus I want to get the JSON format nailed down before opening for business as it were.

On Wed, Feb 1, 2017 at 8:02 AM, Coffin, Chris <[hidden email]> wrote:

Kurt,

 

I think the current language states this, with the exception that it does not mention any expected timeframe. Take a look at the following and let me know if you think we should still add this.

 

Chris

 

------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

From: Kurt Seifried [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 6:24 PM
To: Coffin, Chris <[hidden email]>
Cc: Landfield, Kent B <[hidden email]>; cve-editorial-board-list <[hidden email]>


Subject: Re: Oss-security mailing list policy change communication

 

"Please note that the DWF is not yet ready to handle volume assignments, however the DWF is actively working towards this in the coming weeks and months."

 

With any luck we'll have some stuff done for RSA that we can showcase =)

 

On Tue, Jan 31, 2017 at 3:48 PM, Coffin, Chris <[hidden email]> wrote:

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

<a href="tel:(817)%20637-8026" target="_blank">+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <
[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 



 

--

 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 
[hidden email]




--

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: [hidden email]
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Oss-security mailing list policy change communication

Coffin, Chris

Ok… how is this?

 

------------

oss-security Mailing List Members,

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. Please note that the DWF CNA is not yet ready to handle volume assignments, however they are actively working towards this in the coming weeks and months. Once ready, they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

Regards,

The CVE Team

 

From: Kurt Seifried [mailto:[hidden email]]
Sent: Wednesday, February 01, 2017 10:32 AM
To: Coffin, Chris <[hidden email]>
Cc: Landfield, Kent B <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

yeah I just wanna be super explicit, plus I want to get the JSON format nailed down before opening for business as it were.

 

On Wed, Feb 1, 2017 at 8:02 AM, Coffin, Chris <[hidden email]> wrote:

Kurt,

 

I think the current language states this, with the exception that it does not mention any expected timeframe. Take a look at the following and let me know if you think we should still add this.

 

Chris

 

------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

From: Kurt Seifried [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 6:24 PM
To: Coffin, Chris <[hidden email]>
Cc: Landfield, Kent B <[hidden email]>; cve-editorial-board-list <[hidden email]>


Subject: Re: Oss-security mailing list policy change communication

 

"Please note that the DWF is not yet ready to handle volume assignments, however the DWF is actively working towards this in the coming weeks and months."

 

With any luck we'll have some stuff done for RSA that we can showcase =)

 

On Tue, Jan 31, 2017 at 3:48 PM, Coffin, Chris <[hidden email]> wrote:

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

<a href="tel:(817)%20637-8026" target="_blank">+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <
[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 



 

--

 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 
[hidden email]



 

--

 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 
[hidden email]

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Oss-security mailing list policy change communication

kseifried@redhat.com
works for me, thanks

On Wed, Feb 1, 2017 at 1:48 PM, Coffin, Chris <[hidden email]> wrote:

Ok… how is this?

 

------------

oss-security Mailing List Members,

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. Please note that the DWF CNA is not yet ready to handle volume assignments, however they are actively working towards this in the coming weeks and months. Once ready, they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

Regards,

The CVE Team

 

From: Kurt Seifried [mailto:[hidden email]]
Sent: Wednesday, February 01, 2017 10:32 AM


To: Coffin, Chris <[hidden email]>
Cc: Landfield, Kent B <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

yeah I just wanna be super explicit, plus I want to get the JSON format nailed down before opening for business as it were.

 

On Wed, Feb 1, 2017 at 8:02 AM, Coffin, Chris <[hidden email]> wrote:

Kurt,

 

I think the current language states this, with the exception that it does not mention any expected timeframe. Take a look at the following and let me know if you think we should still add this.

 

Chris

 

------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake web form. At that time, we will inform the community of the change and direct them to the DWF web form. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 

From: Kurt Seifried [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 6:24 PM
To: Coffin, Chris <[hidden email]>
Cc: Landfield, Kent B <[hidden email]>; cve-editorial-board-list <[hidden email]>


Subject: Re: Oss-security mailing list policy change communication

 

"Please note that the DWF is not yet ready to handle volume assignments, however the DWF is actively working towards this in the coming weeks and months."

 

With any luck we'll have some stuff done for RSA that we can showcase =)

 

On Tue, Jan 31, 2017 at 3:48 PM, Coffin, Chris <[hidden email]> wrote:

Hey Kent,

 

I agree with your suggestion. I believe that we can just simply move the DWF paragraph to be the second. Does this work?

 

Chris

 

 ------------

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is the root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

  

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

From: Landfield, Kent B [mailto:[hidden email]]
Sent: Tuesday, January 31, 2017 4:27 PM
To: Coffin, Chris <[hidden email]>; cve-editorial-board-list <[hidden email]>
Subject: Re: Oss-security mailing list policy change communication

 

My comment is about organization. It would be useful to describe the situation with DWF earlier so they know this is temporary. As it is written now it seems to indicate a permanent change and then discusses the future change.

 

If you want specific changes I can do that but I have been slammed and was not able to before COB today.

 

---

Kent Landfield

<a href="tel:(817)%20637-8026" target="_blank">+1.817.637.8026

 

From: <[hidden email]> on behalf of "Coffin, Chris" <[hidden email]>
Date: Friday, January 27, 2017 at 4:12 PM
To: cve-editorial-board-list <
[hidden email]>
Subject: Oss-security mailing list policy change communication

 

All,

 

As discussed in the Board meeting on Jan 25, MITRE agreed to draft an email to the oss-security mailing list describing the policy change in how CVE ID requests will be handled going forward. The following is a draft of that communication for review by the Board. Please provide any feedback or comments by COB Jan 31.

 

Thanks,

 

Chris Coffin

The CVE Team

 

oss-security Mailing List Members,

 

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. From this point forward, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

 

We understand that oss-security is for vulnerabilities that should have immediate public disclosure. You can continue to send details to oss-security and propose that a CVE ID should exist. To actually obtain the CVE ID, please also visit the web form at <https://cveform.mitre.org/>. When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you. Because of this, we strongly prefer that you enter a complete description (including the product name and affected versions) that can be published as-is. Please do not submit only a link URL or only code.

 

The CVE team will continue to watch the oss-security list for any disputes or clarifications about whether a CVE ID should exist or is a duplicate. (More specifically, you can use the oss-security forum to quickly downvote a CVE ID proposal before the CVE ID ever exists.) The CVE team will track this information and include it when considering a CVE assignment. CVE is not abandoning the substantial crowdsourcing value that the mailing list traffic has been providing.

 

If you have had trouble using the <https://cveform.mitre.org/> site, please let us know specifically what happened and how it did not meet your expectations. We would also like to hear your thoughts about what vulnerability information should appear both in an oss-security posting and in the CVE List, and whether some types of information should be in one of these but not the other (e.g., if you want the CVE List to specify the impact whenever possible but not list every exploitation step).

 

The Distributed Weakness Filing (DWF) Project <https://distributedweaknessfiling.org/> is a root CVE Numbering Authority (CNA, described more at <https://cve.mitre.org/cve/cna.html>) that handles open-source software vulnerability requests. The DWF CNA is currently ramping up their operations, but once ready they will be responsible for the assignment of CVE IDs for open-source software (not covered by another CNA) through their own structured intake form, and MITRE will reroute requesters to the DWF CNA form as appropriate. Until that time, MITRE will continue to handle any requests for CVE IDs from oss-security list users who submit them through the web form at <https://cveform.mitre.org/>.

 

For more information or questions regarding this change, you can contact MITRE at [hidden email], submit a comment at <https://cveform.mitre.org/>, or visit us at <https://cve.mitre.org/>.

 

Regards,

 

The CVE Team

 

 



 

--

 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 
[hidden email]



 

--

 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 
[hidden email]




--

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: [hidden email]
Loading...