Re: Simplified Draft Counting Paper for CVE Editorial Board Review

[Pascal Meunier < pmeunier@cerias.purdue.edu >]

    The "incomplete fix == another CVE" mode of operation makes sense to me
   
   
    as the code base has changed, and presumably also the mistakes and
   
   
    assumptions made also changed, which is interesting academically and
   
   
    from a teaching perspective.  The repeated attempts to fix something are
   
   
    interesting to me, and using different CVEs makes that easier to follow
   
   
    and examine.  I believe this is fine and helpful.  Additional coverage
   
   
    and linkage would be more the province of databases based on the CVE, or
   
   
    the CWE.
   

Pascal

On 03/30/2016 08:09 PM, Kurt Seifried wrote:
> One thing to keep in mind I think is that at a high level CVE stands for
> "Common Vulnerabilities and Exposures", so obviously it's used to track
> vulns, but on the other side CVE is also heavily used to track
> remediation,
> be it software updates, workarounds, compensating controls, whatever. A
> good example of this is the search results:
>
> http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=incomplete+fix+for
>
> I'm not sure we need to cover it much beyond the "incomplete fix ==
> another
> CVE", thoughts/comments?
>
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> Red Hat Product Security contact: secalert@redhat.com
>
>