Re: what text is being sent to researchers re: OSS assignments?

["Landfield, Kent B" <kent.b.landfield@intel.com>]

And as has been discussed by the Board, we are working towards getting a landing page that helps direct the requester to the right CNA.  Currently the CNA-covered products link on the https://cveform.mitre.org points to the wrong place – in my mind.  It should point to the https://cve.mitre.org/cve/data_sources_product_coverage.html#products instead. (Consider that a suggestion MITRE. ;-))  In the future the discussed intent is to make it even easier for the requester to locate the proper place to submit a CVE request thus reducing potential confusion. Until then Kurt is handling it properly.

 

---

Kent Landfield

+1.817.637.8026

 

From: Kurt Seifried <kseifried@redhat.com>
Date: Monday, December 19, 2016 at 9:03 AM
To: Kent Landfield <kent.b.landfield@intel.com>
Cc: jericho <jericho@attrition.org>, CVE Editorial Board <cve-editorial-board-list@lists.mitre.org>
Subject: Re: what text is being sent to researchers re: OSS assignments?

 

If I get an Apache request I would forward it to them, I have already done so with a pile of hackerone related requests. 

 

On Mon, Dec 19, 2016 at 7:13 AM, Landfield, Kent B <kent.b.landfield@intel.com> wrote:

Can we please post this to the appropriate place? If you have an issue with this decision that the Board actively discussed, please as the question there.  There is no reason to cross-post every message to both lists.  This was a swim lane issue discussed by the Board and also discussed at the face-to-face meeting we had in Rockville, MD in November.

---
Kent Landfield
+1.817.637.8026

On 12/18/16, 8:44 PM, "owner-cve-cna-list@lists.mitre.org on behalf of jericho" <owner-cve-cna-list@lists.mitre.org on behalf of jericho@attrition.org> wrote:

    Reference:

    https://www.stevencampbell.info/2016/12/my-first-cve-2016-1000329-in-blogphp/

        I submitted my CVE request through Mitre who notified me that open
        source software CVE requests are now processed via the Distributed
        Weakness Filing before being sent to Mitre for inclusion in their
        database.

    This creates an obvious disconnect and potentially duplicate assignments
    and confusion, if researchers are being told to go to DWF for *all* OSS
    assignments. For example, Apache is a CNA and has many OSS projects, but
    vulnerabilities in their software should go to them, not DWF. Could MITRE
    share the text that is being sent out currently?

    .b

 

--

 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com