A new process for CVE assignment [LWN.net]

By Jake Edge
March 8, 2017

In early February, the Common Vulnerabilities and Exposures (CVE) assignment team posted about some changes to the process of getting an ID for an open-source project to the oss-security mailing list. CVE IDs (or just "CVEs") are the standard identifier used for security vulnerabilities and the system has been run by the MITRE Corporation since its inception in 1999. Open-source projects have been getting their CVE IDs by way of the oss-security mailing list for a while now, but that is changing. A new web-based system has been created, but there are still a few wrinkles to iron out in the process.

The basic idea is for CVE requesters to use the new web form, which provides a way to submit a vulnerability description that can more quickly be added to the CVE database. That will help avoid the common, but completely useless ** RESERVED ** entry in the database for an already public vulnerability. As the posting put it:

To more efficiently assign and publish CVE IDs and to enable automation and data sharing within CVE operations, MITRE is changing the way it accepts CVE ID requests on the oss-security mailing list. Starting today, please direct CVE ID requests to this web form <https://cveform.mitre.org/>. Through this form, you can request a new CVE ID, update a CVE ID that was already assigned, and submit questions or feedback to the CVE Team.

[...] When you enter a vulnerability description on the web form, the CVE and description will typically be available on the NVD and CVE web sites at the same time or shortly after we email the CVE ID to you.

But Simon McVittie was concerned that the web form is not particularly well-suited for open-source projects. It is geared toward products from known vendors, rather than projects that are distributed by multiple "vendors":

For open source it seems impractical: for instance, I'm a maintainer of both D-Bus and ikiwiki, neither of which has any particular allegiance to any larger legal entity than the individual maintainers.

Once released, D-Bus is later packaged by Debian, Red Hat, etc., and ikiwiki is packaged in at least Debian and Fedora; but they are not the people issuing releases and do not have any special authority over the upstream project, so there's no particular reason why the upstream maintainers should say that any particular OS distribution is "our vendor".

Or do you expect the upstream maintainers of open source software that is packaged by at least one major distribution to choose one of those distributions arbitrarily, and claim they are the vendor for the purposes of your web form? If so, please make that more clear.

McVittie's complaint was echoed by others, but another concern was raised: oss-security is seen as the place to go for "a reasonably comprehensive and timely list of vulnerabilities for specific products", as Reid Priedhorsky put it. Kurt H. Maier concurred, saying that he would prefer "an alternate solution in place before the CVE system disappears behind an inscrutable web form". The worry is that the mailing list will no longer carry all of the useful information that it currently has. Beyond that, Debian security team member Moritz Muehlenhoff is worried that adding friction to the process of getting a CVE will result in fewer CVEs being requested:

Having CVEs assigned is of lesser importance, this was never primarily why we posted security vulnerabilities here. Obtaining CVE IDs caused little overhead on our side, but if that changes (and the announced changes sound like that), then there will simply be less CVE coverage I'm afraid.

Problems with the CVE system have been apparent for some time. Almost exactly a year ago, LWN looked at the problem. At the time, the Distributed Weakness Filing (DWF) project had just been announced by Kurt Seifried. DWF is meant to assist projects in getting CVE IDs, without needing to be affiliated with some larger product or vendor. In response to some complaints that MITRE's interests do not align well with the open-source world, Adam Caudill pointed out that DWF should neatly help solve many of the problems in the existing system:

Once it's completely up and running, DWF should address these issues. Researchers and organizations can easily become CNAs [CVE Numbering Authorities] under DWF, with assigned CVE blocks. For OSS, the process of getting a CVE (including pre-publication) should be much simpler than it has been, especially in recent years. It's not quite there yet, but Kurt [Seifried] and team have put a lot of effort into laying the groundwork for a much better solution than the ad-hoc "send an email and hope" process that we've become accustomed to.

The old system was far from perfect, as is the interim MITRE web form - hopefully with the help of the community, DWF will be able to provide a better process for all involved. For OSS, DWF is the solution we need to be focused on, and helping it to evolve to suit the needs of everyone.

The CVE assignment team responded to the concerns that were brought up. It is clear that the team expects DWF to step up reasonably soon to manage CVEs and CNAs for open-source projects; the message pointed to some DWF documentation that describes how that will work. MITRE is also amenable to automatically posting the CVE assignments that it makes as a result of the web-form submissions to the oss-security list, which should help those using the list to track vulnerabilities. The team had envisioned that reporters would resend the assignment information to oss-security (and provided an example of that happening), but believes it can automate the process.

There may still be places where improvements are needed, though. There have been occurrences where CVE requests posted to the list were not given a CVE, but were still made public on the list. The web-based process could end up obscuring those reports, as Guido Berhoerster pointed out:

One significant advantage of monitoring this list was that requests were immediately visible and there are sometimes significant delays between a CVE request and the response from MITRE. Or in some cases requests were rejected with a rationale or did not receive a response at all -- with the web form such cases will now just disappear in a black hole.

There was fairly widespread support for automatically posting the CVE assignments (or even the raw form data from public vulnerabilities) to oss-security or another list. Alexander Peslyak (better known as "Solar Designer") suggested that MITRE should implement that, and various others in the thread agreed. Evidently, there are still some internal debates going on at MITRE about how to make that happen. The assignment team posted an update on that in mid-February. There is a concern that information about non-public vulnerabilities would need to be weeded out, so for now the status quo remains:

In general, there's a common case (the requester only provides a basic technical outline of the vulnerability and the commit URL) where implementation is easy. There are several corner cases where implementation is hard. The simple solution is to always ask the requester to make their own (correctly threaded) oss-security post that contains any or all of the response from MITRE. Until we have a better understanding of why that simple solution is incorrect, we are continuing to go with that simple solution.

The main benefit to the new assignment mechanism is in the reduction or even elimination of "RESERVED" entries for already public vulnerabilities that have been assigned CVEs. These are quite common today, so reducing those and replacing them with real information about the flaw is certainly to be welcomed. Once DWF comes fully on-line, it will likely make things even easier. But it appears that open-source security folks are not willing to let go of their oss-security forum and the vulnerability information it currently contains. It may take some tedious resending to make it all happen, but it seems like that will still be done.

Index entries for this article
Security	Bug reporting/CVE

The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:

Note: you can avoid this step in the future by logging into your LWN account.