oss-security - Re: MITRE is adding data intake to its CVE ID process

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170210205916.GB28439@hunt>
Date: Fri, 10 Feb 2017 12:59:16 -0800
From: Seth Arnold <seth.arnold@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: MITRE is adding data intake to its CVE ID process

On Fri, Feb 10, 2017 at 03:40:45PM +0000, Priedhorsky, Reid wrote:
> I’ve been using the CVE requests on oss-security to maintain a
> reasonably comprehensive and timely list of vulnerabilities for specific
> products. It’s not clear to me how to do this when CVE requests happen
> offline in a web form.
> 
> Has this use case been considered? Is there an alternate way to
> accomplish my goal?

Another part of the email from MITRE included "When you enter a
vulnerability description on the web form, the CVE and description will
typically be available on the NVD and CVE web sites at the same time or
shortly after we email the CVE ID to you."

While the oss-security list has been the best resource of information for
CVEs for us, part of our CVE ingestion is to download data from NVD and
MITRE directly:

https://nvd.nist.gov/download
https://cve.mitre.org/data/downloads/allitems.xml

Debian's database is also very useful to us:
https://anonscm.debian.org/viewvc/secure-testing/data/CVE/

And of course our database is freely available as well:
https://code.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/master

I hope this can help you adapt your processes as MITRE adapts theirs.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.