Welcome to the latest issue of the CVE-Announce e-newsletter. This email newsletter is designed to bring recent news about CVE, such as new website features, new CNAs, CVE in the news, etc. right to your email box. Common Vulnerabilities and Exposures (CVE) is the standard for cybersecurity vulnerability names. The CVE Board provides oversight and input into CVE's strategic direction, ensuring CVE meets the vulnerability identification needs of the technology community. CVE Numbering Authorities (CNAs) are vendors, security researchers, and research organizations that assign CVE Identifiers (CVE IDs) to newly discovered issues, and include the CVE IDs in the first public disclosure of the vulnerabilities. Details on subscribing (and unsubscribing) to the email newsletter are at the end. Please feel free to pass this newsletter on to interested colleagues.
Comments: cve@mitre.org
-------------------------------------------------------
CVE-Announce e-newsletter/October 16, 2017
-------------------------------------------------------
Contents:
1. NetApp Added as CVE Numbering Authority (CNA)
2. CVE Blog: "CNA Rules, Version 2.0 to Take Effect on January 1st"
3. Minutes from CVE Board Teleconference Meeting on October 4 Now Available
4. Follow us on LinkedIn and Twitter
5. Details/Credits + Subscribing and Unsubscribing
FEATURE STORY:
NetApp Added as CVE Numbering Authority (CNA)
NetApp, Inc. is now a CVE Numbering Authority (CNA) for all NetApp products, as well as projects hosted on https://github.com/netapp.
CNAs are organizations from around the world that are authorized to assign CVE IDs to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.
CNAs are the main method for requesting a CVE ID. The following 78 organizations currently participate as CNAs: Adobe; Airbus; Alibaba; Apache; Apple; Atlassian; Autodesk; BlackBerry; Brocade; CA; Canonical; CERT/CC; Check Point; Cisco; Dahua; Debian GNU/Linux; Dell EMC; Distributed Weakness Filing Project; Drupal.org; Duo; Eclipse Foundation; Elastic; F5; Flexera Software; Fortinet; FreeBSD; Google; HackerOne; HP; Hewlett Packard Enterprise; Huawei; IBM; ICS-CERT; Intel; IOActive; ISC; JPCERT/CC; Juniper; Kaspersky; KrCERT/CC; Larry Cashdollar; Lenovo; MarkLogic; McAfee; Micro Focus; Microsoft; MITRE (primary CNA); Mozilla; NetApp; Netflix; Netgear; Nvidia; Objective Development; OpenSSL; Oracle; Puppet; Qihoo 360; QNAP; Qualcomm; Rapid 7; Red Hat; Riverbed; Schneider Electric; Siemens; Silicon Graphics; Symantec; Synology; Talos; Tenable; TIBCO; Trend Micro; VMware; Yandex; Zephyr Project; Zero Day Initiative; and ZTE.
For more information about requesting CVE ID numbers from CNAs, visit Request a CVE ID on the CVE website at https://cve.mitre.org/cve/request_id.html.
LINKS:
NetApp -
https://www.netapp.com/
CNAs -
https://cve.mitre.org/cve/cna.html
Request a CVE ID from a CNA -
https://cve.mitre.org/cve/request_id.html
Become a CNA -
https://cve.mitre.org/cve/cna.html#become_a_cna
CVE News page article -
https://cve.mitre.org/news/archives/2017/news.html#October132017_NetApp_Added_as_CVE_Numbering_Authority_CNA
---------------------------------------------------------------
CVE Blog: "CNA Rules, Version 2.0 to Take Effect on January 1st"
The policies and processes managing the CVE Numbering Authorities (CNAs) Program, known as the "CNA Rules," have been revised with significant input from the CNA community. These revised rules, "CVE Numbering Authorities (CNA) Rules, Version 2.0," will go into effect on January 1, 2018.
CNA Rules, Version 2.0, which is updated from Version 1.1, includes the following clarifications and improvements:
* Fixed a number of typos and reworded some phrasing for clarity.
* Clarified existing rules regarding communicating with other vendors or CNAs and the difference between CVE entries that are marked as disputed versus rejected.
* Defined additional terms, such as what it means for a vulnerability to be "public" and the definition of "hardware" within CVE and what hardware can receive CVE IDs.
* Set the CVE JSON format to be the preferred format for submitting CVE requests.
* Removed the CVE assignment requirement for Root CNAs, making it optional.
* A new rule indicating that CNAs must publish their CNA scope on their website as well as some other disclosure process information.
For detailed information about the changes, please see the issue tracker at https://github.com/CVEProject/docs/issues and change logs at https://github.com/CVEProject/docs/tree/cna-documents/cna/CNA%20Rules/CNA%20Rules%20Development.
If you have any questions or comments about the revised CNA Rules document, please contact us via our CVE Request web form at https://cveform.mitre.org/ by selecting Other from the dropdown menu, or email us directly at cve@mitre.org.
We look forward to hearing from you!
- The CVE Team
October 13, 2017
cve@mitre.org
LINKS:
CVE Numbering Authorities -
https://cve.mitre.org/cve/cna.html
Become a CNA -
https://cve.mitre.org/cve/cna.html#become_a_cna
CVE Blog post -
https://cve.mitre.org/blog/index.html#October132017_CNA_Rules_Version_2.0_to_Take_Effect_on_January_1st
---------------------------------------------------------------
Minutes from CVE Board Teleconference Meeting on October 4 Now Available
The CVE Board held a teleconference meeting on October 4, 2017. Read the meeting minutes at https://cve.mitre.org/data/board/archives/2017-10/msg00032.html.
The CVE Board includes numerous cybersecurity-related organizations including commercial security tool vendors, academia, research institutions, government departments and agencies, and other prominent security experts, as well as end-users of vulnerability information. Through open and collaborative discussions, the Board provides critical input regarding the data sources, product coverage, coverage goals, operating structure, and strategic direction of the CVE program. All Board Meetings and Board Email List Discussions are archived for the community.
LINKS:
CVE Board -
https://cve.mitre.org/community/board/index.html
Board Archives -
https://cve.mitre.org/community/board/archive.html#meeting_summaries
https://cve.mitre.org/community/board/archive.html#board_mail_list_archive
CVE News page article -
https://cve.mitre.org/news/archives/2017/news.html#October132017_Minutes_from_CVE_Board_Teleconference_Meeting_on_October_4_Now_Available
---------------------------------------------------------------
Follow us on LinkedIn and Twitter
Please follow us on Twitter for the latest from CVE:
* Feed of the latest CVE IDs -
https://twitter.com/CVEnew/
* Feed of news and announcements about CVE -
https://twitter.com/CVEannounce/
Please also visit us on LinkedIn to more easily comment on our news articles and CVE Blog posts:
* CVE-CWE-CAPEC on LinkedIn -
https://www.linkedin.com/company/11033649
* CVE Blog -
https://cve.mitre.org/blog/
---------------------------------------------------------------
Details/Credits + Subscribing and Unsubscribing
Managing Editor: Dan Adinolfi, Cyber Security Technical Center. Writer: Bob Roberge. The MITRE Corporation (www.mitre.org) maintains CVE and provides impartial technical guidance to the CVE Board and CVE Numbering Authorities on all matters related to ongoing development of CVE.
To unsubscribe from the CVE-Announce e-newsletter, open a new email message and copy the following text to the BODY of the message "SIGNOFF CVE-Announce-List", then send the message to: listserv@lists.mitre.org. To subscribe, send an email message to listserv@lists.mitre.org with the following text in the BODY of the message: "SUBSCRIBE CVE-Announce-List".
Copyright 2017, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. CVE is sponsored by US-CERT (www.us-cert.gov) in the office of Cybersecurity and Communications (www.dhs.gov/office-cybersecurity-and-communications) at the U.S. Department of Homeland Security (www.dhs.gov).
For more information about CVE, visit the CVE website at https://cve.mitre.org or send an email to cve@mitre.org.
