Re: CVE Current States

[Art Manion <amanion@cert.org>]

On 2017-06-14 12:36, Coffin, Chris wrote:
>>> STATE:POPULATED: The CVE entry has been published with at least a 
>>> minimum amount of detail and at least one public reference.
>>> Example: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0002
>>> STATE_DETAIL:N/A (I don't believe it would ever be needed)
>> There is currently a PUBLIC state I think.  Is populated replacing 
>> public?

> I don't believe that we have used terms for this or the previous
> UNASSIGNED. However, I believe there used to be a CVE status that
> included public way back in the day (2004 being that last occurrence
> I think). We should be fine using PUBLIC if that is what others feel
> has been used and is more appropriate.
I think I saw STATE : PUBLIC in the MITRE CoDev git repo, but can't 
check right now.

I don't feel strongly about PUBLIC vs. POPULATED, but agree there 
should be a state to indicate a correct (syntactically and to the best 
of current knowledge materially) and published entry.

 - Art