Re: Simplified Draft Counting Paper for CVE Editorial Board Review

[Pascal Meunier <pmeunier@cerias.purdue.edu>]

The "incomplete fix == another CVE" mode of operation makes sense to me 
as the code base has changed, and presumably also the mistakes and 
assumptions made also changed, which is interesting academically and 
from a teaching perspective.  The repeated attempts to fix something are 
interesting to me, and using different CVEs makes that easier to follow 
and examine.  I believe this is fine and helpful.  Additional coverage 
and linkage would be more the province of databases based on the CVE, or 
the CWE.

Pascal

On 03/30/2016 08:09 PM, Kurt Seifried wrote:
> One thing to keep in mind I think is that at a high level CVE stands for
> "Common Vulnerabilities and Exposures", so obviously it's used to track
> vulns, but on the other side CVE is also heavily used to track 
> remediation,
> be it software updates, workarounds, compensating controls, whatever. A
> good example of this is the search results:
>
> http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=incomplete+fix+for
>
> I'm not sure we need to cover it much beyond the "incomplete fix == 
> another
> CVE", thoughts/comments?
>
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> Red Hat Product Security contact: secalert@redhat.com