CVE-CNA JSON Format Proposal

["Booth, Harold (Fed)" <harold.booth@nist.gov>]

Background

The CVE Automation Working Group met yesterday and one of the outcomes from that meeting was the final approval of the changes for the JSON Format that MITRE can use for exchanging CVE information with CNAs and other interested parties.

Proposed Recommendation

The working group is proposing that the format available at https://github.com/CVEProject/automation-working-group/blob/master/cve_json_schema/DRAFT-JSON-file-format-v4.md be used as the structured format for CNAs to submit CVE information effective as soon as the this recommendation has been accepted by the board.

Response Period: One Week: Ends March 28, 2017

 

Additional Considerations

While the above recommendation is currently only intended to augment the existing mechanisms for submission, the board along with MITRE will need to consider how to transition/encourage CNAs to using this mechanism in order to obtain the benefits of using a structured format.