|
|
|||
|
|
|
|||
Yes, Yes, and Yes.... vxref is what we should be using.
--
Kent Landfield
817-637-8026
kent_landfield@mcafee.com
On 5/3/17, 5:12 PM, "owner-cve-editorial-board-list@lists.mitre.org on
behalf of Art Manion" <owner-cve-editorial-board-list@lists.mitre.org
on behalf of amanion@cert.org> wrote:
On 2017-05-03 15:36, Kurt Seifried wrote:
> DUPLICATE_OF [CVE]
>
> SPLIT_TO [list of CVEs]
>
> MERGED_TO [lCVE]
If we're going to get into relationships between vulnerabilities --
which is related to, but possibly a bit beyond state -- I'd like to
brief the board (or automation group) on vxref, which is a
structured
relationship system.
https://github.com/FIRSTdotorg/vrdx-sig-vxref-wip/tree/master/vxref
https://github.com/CERTCC-Vulnerability-Analysis/Vulnerability-Data-Archive-Tools
Regards,
- Art
