On 2018-05-16 13:00, Waltermire, David A. (Fed) wrote:
Since this information can also appear in a dedicated field in CVE
feeds, this seems to be duplicative in nature. This is not a widely
used practice yet. Is this a practice that board wants to
encourage/discourage?
CVSS scores, or ideally, just the vectors, should go in the appropriate
CVSS field in the CVE format, and not in the description. I am in
favor of discouraging the practice.
I'd rather work towards:
1. A more comprehensive, standard set of fields for a vulnerability (or
vulnerability report), such as the NIST VDO.
2. A standard CVE record that complies with #1 but that only requires
the carefully selected minimum fields to achieve CVE mission:
Vulnerability identification. Severity, priority, CVSS or otherwise,
are not needed for this mission and are extraneous and distracting.
CVSS as an optional field in a CVE record is fine, and users can
currently grab that information from JSON files in git. Maybe MITRE
CVE or NVD would choose to expose CVSS and other optional data from CVE
records.
There is clearly a user need for #1, and people are happy enough to
just treat a CVE record as a more comprehensive vulnerability record.
I'm reasonably happy to work on #2 before #1 and back-fit #1 if that is
more practical.
- Art
