NOTE:
The CVE naming scheme was modified on 19 October
2005 to replace the "CAN" prefix with a "CVE" prefix in CVE names.
CVE names (also called "CVE numbers," "CVE-IDs," and "CVEs") are unique, common identifiers for publicly known information security vulnerabilities. CVE names have "entry" or "candidate" status. Entry status indicates that the CVE name has been accepted to the
CVE
List
while candidate status (also called "candidates," "candidate numbers," or "CANs") indicates that the name is under review for inclusion in the list.
Each CVE name includes the following:
-
CVE identifier number (i.e., "CVE-1999-0067").
-
Indication of "entry" or "candidate" status.
-
Brief description of the security vulnerability or exposure.
-
Any pertinent references (i.e., vulnerability reports and advisories or OVAL-ID).
The process of creating a CVE name begins with the discovery of a potential security vulnerability or exposure. The information is then assigned a CVE candidate number by a
CVE
Candidate Numbering Authority
(CNA), posted on the CVE Web site, and proposed to the Board by the CVE Editor. As part of its management of CVE,
The
MITRE Corporation
functions as Editor and Primary CNA. The
CVE
Editorial Board
discusses the candidate and votes on whether or not it should become a CVE entry. If the candidate is rejected, the reason for rejection is noted in the
Editorial
Board Archives
posted on the CVE Web site. If the candidate is accepted, its status is updated to "entry" on the
CVE
List
. However, the assignment of a candidate number is not a guarantee that it will become an official CVE entry.
The documents below explain CVE names and the creation of CVE names in more detail:
A description of the three stages of the process of building the
CVE
List
: (1) the Initial Submission Stage, (2) Candidate Stage, and (3) Entry Stage. Also included is a description of the procedures for modifications and deletions in the CVE List.
This document includes a full discussion of CVE names with "candidate" status,
also called candidates, candidate numbers, and CANs, including what a candidate
is, the two ways new security issues become candidates, how long it takes
for candidates to be moved from candidate to entry status, how candidates
are affected by CVE content decisions, and how users can find out about the
most recent candidates.
CVE Content Decisions, or CDs, are the guidelines the CVE Content Team uses to ensure that CVE names are created in a consistent fashion, independent of who is doing the creation. This page is a central location of information about, and related to, CDs including the following:
CVE
Content Decisions Overview
;
CVE
Abstraction Content Decisions: Rationale
and Application
; and
Handling Duplicate
Public CVE Identifiers
.
Each CVE name includes appropriate references. Each reference used in CVE (1) identifies the source, (2) includes a well-defined identifier to facilitate searching on a source's Web site, and (3) notes the associated CVE name. CVE also includes a
Reference
Maps
page with links to documents from the commonly used information sources that are used as references for CVE entries and candidates.
A list of the organizations from the information security community that provide us with vulnerability information that helps MITRE create new CVE candidates.
New CVE versions are created approximately once per quarter. When they are released Version Reports are also made available that list the differences between versions. This page also includes a description of the various versions of CVE that have been released.
Back to top
Additional Information
Includes an introduction to the candidate reservation process, defines Candidate Numbering Authorities (CNAs), provides the requirements for being a CNA, describes CNA tasks, explains the communication requirements from the CNA to MITRE, defines the role of vendor liaisons, and explains the researcher's responsibilities in the process. Also included is a list of the several organizations currently participating as CNAs.
Describes how to obtain a candidate number from a CNA, or alternatively,
the Primary CNA. Includes instructions for requesting the Initiative's "CVE Candidate Reservation Guidelines for Researchers" and
a link to our list of Researcher Responsibilities.
FAQs
The following
FAQs
from the Frequently Asked Questions page in the
About
CVE
section also address specific questions about CVE names with entry and
candidate status:
What is CVE?
What is a "vulnerability"?
What is an "exposure"?
What is a CVE name?
What is a CVE entry?
Are there references available for CVE entries?
What is a CVE "candidate"?
Are there references available for CVE candidates?
Does every CVE entry start as a candidate?
How does a vulnerability or exposure become a CVE entry?
Does CVE have a procedure for determining how to assign candidates to newly discovered or legacy vulnerabilities?
How long does it take for a candidate to become a CVE entry?
How can I find out when new candidates are added to the CVE Web site?
I discovered a new vulnerability or exposure. How can I obtain a CVE Candidate?
Back to top
|
