3 ms·

Not CVE – vulnerability disclosure for issues that vendors don't acknowledge

• marcus0x62 3y ago
  Under current CVE rules, vendors are "are left to their own discretion to determine whether something is a vulnerability". The !CVE program provides a space to report vulnerabilities that vendors do not acknowledge, but that are nonetheless important to the security community.
  • josephcsible 3y ago
    > Under current CVE rules, vendors are "are left to their own discretion to determine whether something is a vulnerability". I don't think that's true (at least not in practice), because if it were, then problems like https://news.ycombinator.com/item?id=37267940 https://news.ycombinator.com/item?id=37267940 and https://news.ycombinator.com/item?id=37394919 https://news.ycombinator.com/item?id=37394919 wouldn't happen.
    • marcus0x62 3y ago
      Both of your examples are for Curl. Daniel isn't a "CVE Numbering Authority", so he can't arbitrarily reject CVEs for Curl that he doesn't want to acknowledge. Big software vendors generally are[0] and have much more leeway in deciding to grant a CVE or not for their own products. The two examples you provided are a problem, but so is the current CNA system that is an inherent conflict of interest. 0 - https://www.cve.org/PartnerInformation/ListofPartners https://www.cve.org/PartnerInformation/ListofPartners
  • jruohonen 3y ago
    Interesting initiative! How do you deal with validation and fakes that typically plague these things, if I may ask?
    • marcus0x62 3y ago
      I'm not affiliated with !CVE in any way, but based on what I've read, they have a standard review committee minus the whole CNA scheme. If I was affiliated, I'd want to see a POC for whatever someone was claiming.