RE: DWV JSON format Version 2.0 (breaks some compat with Version 1.x)

["Millar, Thomas" <Thomas.Millar@hq.dhs.gov>]

...Thanks, touchscreen.

Impact is a tricky term and is extremely context-dependent. I'd 
recommend leaving it out or making it so that a strict reference to an 
attack or incident is the only acceptable input. And obviously that's 
dependent on humans and semantics getting along.



Tom Millar, US-CERT

Sent from +1-202-631-1915
https://www.us-cert.gov

________________________________
From: Millar, Thomas
Sent: Wednesday, October 19, 2016 11:07:08 PM
To: Kurt Seifried; cve-editorial-board-list
Subject: RE: DWV JSON format Version 2.0 (breaks some compat with 
Version 1.x)

In this case we mean impact of the vulnerability being exploited, 
right? I have no knowledge of a good taxonomy for



Tom Millar, US-CERT

Sent from +1-202-631-1915
https://www.us-cert.gov

________________________________
From: owner-cve-editorial-board-list@lists.mitre.org on behalf of Kurt 
Seifried
Sent: Wednesday, October 19, 2016 8:41:42 PM
To: cve-editorial-board-list
Subject: Re: DWV JSON format Version 2.0 (breaks some compat with 
Version 1.x)

The corrected one with SOURCES as well. One thing MITRE asks for is 
IMPACT, I didn't add that yet because as far as I know there's no 
standard for that (ala CWE/OWASP), so if anyone knows of a good IMPACT 
(a list of keywords even?) that would be useful, otherwise I'll just 
make it atext field I guess, it'll be an additive change anyways so 
won't break backwards compatibility so 2.1 or whatever can have it.

{
  "VERSION": "2.0",
  "UPDATED": "DATE-TIMESTAMP",
  "SERIAL": "INT",
  "NOTES": {
    "eng": "Text data here",
    "ger": "Textdaten hier",
    "jpn": "ここにテキストデータ"
  },
  "DWF": {
    "VERSION": "2.0",
    "CVE_ID": "CVE-YEAR-NNNNNNN",
    "PROBLEM_TYPE": {
      "CWE": "X",
      "OWASP": "X",
      "DESCRIPTION": {
        "eng": "String description of issue",
        "ger": "String Beschreibung des Problems",
        "jpn": "問題の説明文字列"
      }
    },
    "CVSSv2": {
      "VERSION": "2.0",
      "BM": {
        "AV": "X",
        "AC": "X",
        "AU": "X",
        "C": "X",
        "I": "X",
        "A": "X",
        "SCORE": "N.N",
        "NOTES": "string"
      },
      "TM": {
        "E": "X",
        "RL": "X",
        "RC": "X",
        "SCORE": "N.N",
        "NOTES": "string"
      },
      "EM": {
        "CDP": "X",
        "TD": "X",
        "CR": "X",
        "IR": "X",
        "AR": "X",
        "SCORE": "N.N",
        "NOTES": "string"
      },
      "NOTES": "string"
    },
    "CVSSv3": {
      "VERSION": "2.0",
      "BM": {
        "AV": "X",
        "AC": "X",
        "PR": "X",
        "UI": "X",
        "S": "X",
        "C": "X",
        "I": "X",
        "A": "X",
        "SCORE": "N.N",
        "NOTES": "string"
      },
      "TM": {
        "E": "X",
        "RL": "X",
        "RC": "X",
        "SCORE": "N.N",
        "NOTES": "string"
      },
      "EM": {
        "CR": "X",
        "IR": "X",
        "AR": "X",
        "MAV": "X",
        "MAC": "X",
        "MPR": "X",
        "MUI": "X",
        "MS": "X",
        "MC": "X",
        "MI": "X",
        "MA": "X",
        "SCORE": "N.N",
        "NOTES": "string"
      }
    },
    "AFFECTS": [
      {
        "VENDOR": "string",
        "PRODUCT": "string",
        "VERSION": "string",
        "CPE": "cpe_string",
        "SWID": "swid_string (XML data with line breaks)",
        "AFFECTED": [
          "1.0",
          "2.0.6"
        ],
        "FIXEDIN": [
          "1.3",
          "2.0.7"
        ],
        "NOTES": {
          "eng": "Text data here",
          "ger": "Textdaten hier",
          "jpn": "ここにテキストデータ"
        }
      }
    ],
    "DESCRIPTION": {
      "eng": "String description of issue",
      "ger": "String Beschreibung des Problems",
      "jpn": "問題の説明文字列"
    },
    "REFERNCES": [
      {
        "VERSION": "2.0",
        "NAME": "name of source (can be URL)",
        "DESCRIPTION": {
          "eng": "String description of issue",
          "ger": "String Beschreibung des Problems",
          "jpn": "問題の説明文字列"
        },
        "TYPE": "WWW/PDF/TEXT/EMAIL/etc.",
        "FILES": [
          {
            "URL": "URL to source",
            "IMPORTTIME": "DATE-TIMESTAMP",
            "LOCALNAME": "local filename",
            "FORMAT": "string",
            "NOTES": "string"
          }
        ]
      }
    ],
    "EXPLOITATION": {
      "eng": "Text data here",
      "ger": "Textdaten hier",
      "jpn": "ここにテキストデータ"
    },
    "WORKAROUND": {
      "eng": "Text data here",
      "ger": "Textdaten hier",
      "jpn": "ここにテキストデータ"
    },
    "CREDITS": [
      {
        "VERSION": "2.0",
        "ID": {
          "type_of_id_string": "string"
        },
        "ROLE": [
          "role_name_string"
        ],
        "NOTES": {
          "eng": "Text data here",
          "ger": "Textdaten hier",
          "jpn": "ここにテキストデータ"
        }
      }
    ],
    "TIMELINE": [
      {
        "VERSION": "2.0",
        "TIMESTAMP": "DATE-TIMESTAMP",
        "SOURCE": {
          "type_of_id_string": "string"
        },
        "TEXT": {
          "eng": "Text data here",
          "ger": "Textdaten hier",
          "jpn": "ここにテキストデータ"
        },
        "NOTES": {
          "eng": "Text data here",
          "ger": "Textdaten hier",
          "jpn": "ここにテキストデータ"
        }
      }
    ],
    "SOURCE": {
      "DISCOVERED_BY": "X",
      "DISCOVERED_WITH": "X",
      "VERIFICATION": "X",
      "CNA_CHAIN": [
        "initial CNA",
        "parent CNA",
        "root CNA"
      ]
    },
    "NOTES": {
      "eng": "Text data here",
      "ger": "Textdaten hier",
      "jpn": "ここにテキストデータ"
    }
  },
  "COMMUNITY": {
    "VERSION": "2.0"
  },
  "EXPERIMENTAL": {
    "VERSION": "2.0"
  },
  "VENDOR": {
    "VERSION": "2.0",
    "Example Vendor Name": {
      "VERSION": "2.0",
      "PROBLEMTYPE": "same as in DWF section",
      "CVSSv2": "same as in DWF section",
      "CVSSv3": "same as in DWF section",
      "AFFECTS": "same as in DWF section",
      "DESCRIPTION": "same as in DWF section",
      "REFERENCES": "same as in DWF section",
      "EXPLOITATION": "same as in DWF section",
      "WORKAROUND": "same as in DWF section",
      "CREDITS": "same as in DWF section",
      "TIMELINE": "same as in DWF section",
      "NOTES": "same as in DWF section",
      "Example Product Name": {
        "VERSION": "2.0",
        "PROBLEMTYPE": "same as in DWF section",
        "CVSSv2": "same as in DWF section",
        "CVSSv3": "same as in DWF section",
        "AFFECTS": "same as in DWF section",
        "DESCRIPTION": "same as in DWF section",
        "REFERENCES": "same as in DWF section",
        "EXPLOITATION": "same as in DWF section",
        "WORKAROUND": "same as in DWF section",
        "CREDITS": "same as in DWF section",
        "TIMELINE": "same as in DWF section",
        "NOTES": "same as in DWF section"
      }
    }
  }
}

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: 
secalert@redhat.com<mailto:secalert@redhat.com>