Re: Required information for CVE entry submissions

[Art Manion <amanion@cert.org>]

On 9/13/17 11:15 AM, Adinolfi, Daniel R wrote:

> CVEID
>
> PRODUCT, including vendor/project
>
> VERSION, describing what versions are and are not affected
>
> PROBLEMTYPE, a free-form bit of data, though some use CWEs here
>
> REFERENCES, URLs pointing to public information about the
> vulnerability that includes all the information that may be in the
> CVE entry
>
> DESCRIPTION, a human-readable description of the vulnerability
> To summarize the proposed changes, the following information would be
> required under the proposals:
>
> CVEID
>
> PRODUCT
>
> VERSION
>
> PROBLEM TYPE
>
> PUBLICATION DATE (of the vulnerability information becoming public;
> or a timeline of specific events related to the vulnerability being
> made public)
>
> ASSIGNING CNA (or chain of assigning CNAs if there is a Sub-CNA under
> a Root doing the assignment)
>
> IMPACT> 
> There is also a proposal to remove REFERENCES from required information if all the required information can be included in the description. There is a related discussion as to whether the CVE List can include vulnerability information not found anywhere else, acting as a first publication point. <https://github.com/CVEProject/docs/issues/26>
>
> DESCRIPTION would also become optional, the argument being that all the 
> same information would be available in the required fields.
>
> We do not currently have a proposed categorization or taxonomy of 
> "IMPACT".

Require DESCRIPTION.  I don't think the other fields are (yet) careful enough 
about capturing "all" the necessary information.

Require REFERENCES.  CVE's mission is primarily identification, not 
publication or disclosure.  Yes, a well-detailed CVE entry could 
possibly contain enough information to act as a primary publication, 
but that's across the scope line for me.  If CVE can be the 
primary/first/only documentation of a vulnerability, we need more 
fields and more effort.

Require ASSIGNING CNA.

Make IMPACT optional, it is very dependent on context and can be 
optionally covered in DESCRIPTION.

Also on the call today, there was an important discussion about 
providing better guidance/semantics for what goes in fields.

Regards,

 - Art