Re: Current and future CVE states

[Kurt Seifried <kseifried@redhat.com>]

I agree in principle but I needed something basic now, and merged to/duplicate of/split from covers, well, basically every case I've seen in several thousand CVEs.

On Wed, May 3, 2017 at 4:20 PM, Landfield, Kent <Kent_Landfield@mcafee.com> wrote:

Yes, Yes, and Yes....  vxref is what we should be using.

--
Kent Landfield
817-637-8026
kent_landfield@mcafee.com

On 5/3/17, 5:12 PM, "owner-cve-editorial-board-list@lists.mitre.org on behalf of Art Manion" <owner-cve-editorial-board-list@lists.mitre.org on behalf of amanion@cert.org> wrote:

    On 2017-05-03 15:36, Kurt Seifried wrote:

    > DUPLICATE_OF [CVE]
    >
    > SPLIT_TO [list of CVEs]
    >
    > MERGED_TO [lCVE]

    If we're going to get into relationships between vulnerabilities --
    which is related to, but possibly a bit beyond state -- I'd like to
    brief the board (or automation group) on vxref, which is a structured
    relationship system.

    https://github.com/FIRSTdotorg/vrdx-sig-vxref-wip/tree/master/vxref

    https://github.com/CERTCC-Vulnerability-Analysis/Vulnerability-Data-Archive-Tools

    Regards,

     - Art

--

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com