Re: Simplified Draft Counting Paper for CVE Editorial Board Review

[Art Manion <amanion@cert.org>]

On 2016-03-28 12:24, Common Vulnerabilities & Exposures wrote:

> Please find attached to this note a copy of the draft CVE Simplified
> Counting Paper. The paper was originally prepared as an internal piece
> to help the CVE analysts orient their thinking, and we thought that it
> would be useful to share it with the Board as background before the
> Board meeting Wednesday afternoon.

Comments added.

At a high level, even more tolerance for assignment criteria, increased
assignment (by MITRE and/or CNAs) is necessary to keep up with reality.
 A direct affect is an increased need for split/merge/reject cleanup.

Perhaps, vaguely reminiscent of CAN/CVE days, CVE entries get a flag
that can be set by MITRE or a CNA to distinguish "claimed
vulnerabilities, report looks plausible, public reference" from "vendor
acknowledged, or otherwise substantiated claim, public reference."

 - Art

Attachment: CVE_counting_cert.docx
Description: Zip archive