Re: CVE-CNA JSON Format Proposal

[Kurt Seifried <kurt@seifried.org>]

So the DWF will require the ASSIGNER, and ideally also the 

"source":{
	"discovered_by":"name of discover",
	"discovered_with":"name of parties involved",
	"verification":"string",
	"cna_chain":[
	"string initial CNA",
	"string Parent CNA",
	"string root CNA"
	]
	},

would be automatically created as the CVE flows through the CNA chain to the DWF and then MITRE hopefully. 

On Wed, Mar 22, 2017 at 12:52 PM, Art Manion <amanion@cert.org> wrote:

On 3/21/17 9:36 AM, Booth, Harold (Fed) wrote:

> The working group is proposing that the format available at
> https://github.com/CVEProject/automation-working-group/blob/master/cve_json_schema/DRAFT-JSON-file-format-v4.md
> be used as the structured format for CNAs to submit CVE information
> effective as soon as the this recommendation has been accepted by the board.

This partially came up on today's board call:

Should ASSIGNER be required as part of the minimal example?  I'd say yes.

ASSIGNER is currently an email address, should it be a CNA name?  I'd
say maybe, someone would otherwise have to map email addresses to CNAs.

 - Art

--

Kurt Seifried
kurt@seifried.org