Security

A new process for CVE assignment

In early February, the Common Vulnerabilities and Exposures (CVE) assignment team posted about some changes to the process of getting an ID for an open-source project to the oss-security mailing list. CVE IDs (or just "CVEs") are the standard identifier used for security vulnerabilities and the system has been run by the MITRE Corporation since its inception in 1999. Open-source projects have been getting their CVE IDs by way of the oss-security mailing list for a while now, but that is changing. A new web-based system has been created, but there are still a few wrinkles to iron out in the process.

The basic idea is for CVE requesters to use the new web form, which provides a way to submit a vulnerability description that can more quickly be added to the CVE database. That will help avoid the common, but completely useless ** RESERVED ** entry in the database for an already public vulnerability. As the posting put it:

But Simon McVittie was concerned that the web form is not particularly well-suited for open-source projects. It is geared toward products from known vendors, rather than projects that are distributed by multiple "vendors":

McVittie's complaint was echoed by others, but another concern was raised: oss-security is seen as the place to go for "a reasonably comprehensive and timely list of vulnerabilities for specific products", as Reid Priedhorsky put it. Kurt H. Maier concurred, saying that he would prefer "an alternate solution in place before the CVE system disappears behind an inscrutable web form". The worry is that the mailing list will no longer carry all of the useful information that it currently has. Beyond that, Debian security team member Moritz Muehlenhoff is worried that adding friction to the process of getting a CVE will result in fewer CVEs being requested:

Problems with the CVE system have been apparent for some time. Almost exactly a year ago, LWN looked at the problem. At the time, the Distributed Weakness Filing (DWF) project had just been announced by Kurt Seifried. DWF is meant to assist projects in getting CVE IDs, without needing to be affiliated with some larger product or vendor. In response to some complaints that MITRE's interests do not align well with the open-source world, Adam Caudill pointed out that DWF should neatly help solve many of the problems in the existing system:

The CVE assignment team responded to the concerns that were brought up. It is clear that the team expects DWF to step up reasonably soon to manage CVEs and CNAs for open-source projects; the message pointed to some DWF documentation that describes how that will work. MITRE is also amenable to automatically posting the CVE assignments that it makes as a result of the web-form submissions to the oss-security list, which should help those using the list to track vulnerabilities. The team had envisioned that reporters would resend the assignment information to oss-security (and provided an example of that happening), but believes it can automate the process.

There may still be places where improvements are needed, though. There have been occurrences where CVE requests posted to the list were not given a CVE, but were still made public on the list. The web-based process could end up obscuring those reports, as Guido Berhoerster pointed out:

There was fairly widespread support for automatically posting the CVE assignments (or even the raw form data from public vulnerabilities) to oss-security or another list. Alexander Peslyak (better known as "Solar Designer") suggested that MITRE should implement that, and various others in the thread agreed. Evidently, there are still some internal debates going on at MITRE about how to make that happen. The assignment team posted an update on that in mid-February. There is a concern that information about non-public vulnerabilities would need to be weeded out, so for now the status quo remains:

The main benefit to the new assignment mechanism is in the reduction or even elimination of "RESERVED" entries for already public vulnerabilities that have been assigned CVEs. These are quite common today, so reducing those and replacing them with real information about the flaw is certainly to be welcomed. Once DWF comes fully on-line, it will likely make things even easier. But it appears that open-source security folks are not willing to let go of their oss-security forum and the vulnerability information it currently contains. It may take some tedious resending to make it all happen, but it seems like that will still be done.

Comments (2 posted)

Security quotes of the week

Comments (11 posted)

How Threat Modeling Helps Discover Security Vulnerabilities (Red Hat Security Blog)

Comments (none posted)

Alert summary March 2, 2017 to March 8, 2017