Phase 3 of the phased deprecation of legacy CVE content download formats (i.e., CSV, HTML, XML, and CVRF) scheduled for the first half of 2024 is underway. In Phase 3, per the phase-out schedule noted below, the legacy download formats will only be updated once per month in March, April, May, and June 2024. They will no longer be updated after June 30, 2024.

The legacy download formats have been replaced by CVE JSON as the only supported format for CVE Records and downloads. See below.

This change was first announced in July 2023 in a CVE Blog article entitled “Legacy CVE Download Formats Will Be Phased Out Beginning January 1, 2024” on the CVE.ORG website and promoted throughout the remainder of 2023 in the CVE Announce email newsletter and on CVE social media. A second blog article, “Deprecation of Legacy CVE Download Formats Now Underway,” was published in January 2024, and a third, “Phase 2 of Legacy CVE Download Formats Deprecation Now Underway,” was published in February 2024, and promoted on the CVE.ORG website, in the CVE Announce email newsletter, and on CVE social media.

Phase-Out Schedule

Phased deprecation means that the frequency of updates to the legacy download formats will be reduced over the coming months until they are no longer updated at the end of June 2024.

To assist consumers with their transition to the new format, the frequency of updates to the legacy download formats are being reduced from daily updates (which ended on December 31, 2023) to updates on the following schedule:

New Format for CVE Records and Downloads

CVE Downloads in our new official data format for CVE Records, “CVE JSON,” are hosted in the cvelistV5 repository on GitHub.com. Update frequency and other details are available in the repository ReadMe.

CVE JSON is a richer, more structured format for vulnerability identification and description and will provide enhanced information for your customers. The schema for this new format is also available on GitHub.

Who Is Affected?

CVE Numbering Authority (CNA) partners, tool vendors, and other parties that use CVE download files for automation or other purposes should pay particular attention to this change.

Take Action Now!

Product teams and others need to update their tools and processes to the new supported format prior to these legacy format download files no longer being updated after June 30, 2024.

Please use our CVE Blog website feedback form, comment on the CVE Blog on Medium, or use the CVE Request Web forms and select “Other” from the dropdown menu, to provide feedback about this article.

The document has already been reviewed by the CVE Board and the program’s CNA Partners. We are now making the document available for review and comment by the CVE user community.

In addition to the CNA Operational Rules document there is an Editing Process document that you should read prior to entering comments in the rules document draft. Links to both documents, as well as other details, are provided below.

Review Period

The community review period will last two (2) weeks:

• Opens: March 06, 2024, at 11:59 p.m. ET
• Closes: March 20, 2024, at 11:59 p.m. ET

Editing Process

All documents are provided in Google Docs. A Google account may be required to access the documents. If you are unable to use Google Docs, please contact us at cve-rules@googlegroups.com to request an alternative format.

By following the instructions in the Editing Process document, you will enhance our ability to expedite organizing, reviewing, and addressing all collected comments. Please read the Editing Process document prior to reviewing the CNA Operational Rules document.

The “Editing Process” document is located here.

Rules Document for Review and Comment

The “CNA Operational Rules” document, which will only be accessible during the review period, is located here.

To review only selected highlights of changes from the previous version of the document, click here.

Final Publication

This is the first major revision of the CNA Operational Rules that will explicitly include public input. We expect to learn from this revision process and develop a more robust and repeatable process for future revisions of the CNA Operational Rules and other CVE Program documents.

The final version of the document will be published later in 2024.

CVE Numbering Authorities (CNAs) — VulnCon 2024 takes the place of this year’s Spring CVE Global Summit.

Registration

In-person and virtual registration are open until March 11, 2024, at 11:59 UTC, on this FIRST web page. Please note that discounted rates are not being offered for this event regardless of membership or speaking status. Register now using FIRST’s Event Registration Form.

• Standard Admission: US $250.00
• Virtual Admission: US $100.00

Registration fees for standard admission include three days of coffee breaks and buffet lunches, one networking reception, and applicable meeting materials.

Additional Details:

• In-Person Registration — Located in the main lobby of the McKimmon Conference and Training Center (see venue section below). Please have a copy of your ID or registration confirmation readily available to assist with badge collection. Registration will open at 07:30 all three days.
• Virtual Attendance — All presentations will be TLP:CLEAR and streamed for those interested in virtual participation. Virtual registration is available within the registration form. Streaming will be delivered over Zoom.

Venue:

McKimmon Center
North Carolina State University
1101 Gorman St.
Raleigh, North Carolina 27606
USA

About VulnCon 2024

The purpose of VulnCon — which is open to the public — is to collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem. A key goal of the conference is to understand what important stakeholders and programs are doing within the vulnerability management ecosystem and best determine how to benefit the ecosystem broadly.

Learn More

For most up-to-date information, visit the CVE/FIRST VulnCon 2024 conference page hosted on the FIRST website.

We look forward to seeing you at this first-ever community event!

CVE Numbering Authorities (CNAs), please note that VulnCon 2024 takes the place of this year’s Spring CVE Global Summit. Register today!

Registration

In-person and virtual registration are open now on this FIRST web page. Please note that discounted rates are not being offered for this event regardless of membership or speaking status.

• Standard Admission: US $250.00
• Virtual Admission: US $100.00

Registration fees for standard admission include three days of coffee breaks and buffet lunches, one networking reception, and applicable meeting materials.

Additional Details:

• In-Person Registration — Located in the main lobby of the McKimmon Conference and Training Center (see venue section below). Please have a copy of your ID or registration confirmation readily available to assist with badge collection. Registration will open at 07:30 all three days.
• Virtual Attendance — All presentations will be TLP:CLEAR and streamed for those interested in virtual participation. Virtual registration is available within the registration form. Streaming will be delivered over Zoom.

Register now using FIRST’s Event Registration Form.

Venue:

McKimmon Center
North Carolina State University
1101 Gorman St.
Raleigh, North Carolina 27606
USA

About VulnCon 2024

The purpose of VulnCon — which is open to the public — is to collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem. A key goal of the conference is to understand what important stakeholders and programs are doing within the vulnerability management ecosystem and best determine how to benefit the ecosystem broadly.

Learn More

For most up-to-date information, visit the CVE/FIRST VulnCon 2024 conference page hosted on the FIRST website.

We look forward to seeing you at this first-ever community event and encourage you to register today!

Per the CVE Board Charter, “Section 1.3.3 CNA Liaison — A single seat on the Board is reserved for a CNA Liaison who represents the CNA community, and ensures CNAs are updated with various status and activity-related information. This is an elected position which CVE Numbering Authorities (CNAs) vote on annually. The liaison is a voting member of the Board, with a one-year term, and can serve more than one consecutive term if the CNA community desires as indicated by the results of the voting. This position is a two-way conduit for CNAs to bring things to and from the Board in a more official and structured way.”

About MegaZone

MegaZone (yes, that’s his name, call him MZ) has been with F5 since 2010, and the F5 SIRT (Security Incident Response Team) since 2016, where he is currently a Principal Security Engineer. Prior to F5, he worked at Xylogics, Livingston Enterprises, Lucent, GTE Internetworking (BBN), Sling Media, and a few others, after graduating from Worcester Polytechnic Institute (WPI) in 1994.

MegaZone has been involved with the CVE Program since F5 joined as a CNA in 2016 and has taken an increasingly active role over time, eventually running out of working groups to join. He is currently representing the CNA community in the Automation Working Group (AWG), CNA Coordination Working Group (CNACWG), Outreach and Communications Working Group (OCWG), Strategic Planning Working Group (SPWG), Tactical Working Group (TWG), Quality Working Group (QWG), and Vulnerability Conference and Events Working Group (VCEWG), including being a co-chair of the last two. He is honored to further represent the CNA community before the CVE Board in his new role as CNA Liaison.

Outside of work he collects whisk(e)y, enjoys travel with his wife (often Disney-related), and volunteers to help a local non-profit in their small Massachusetts town with their tech issues.

About the CVE Board

The CVE Board is the organization responsible for the strategic direction, governance, operational structure, policies, and rules of the CVE Program. The Board includes members from numerous cybersecurity-related organizations including commercial security tool vendors, academia, research institutions, government departments and agencies, and other prominent security experts, as well as end-users of vulnerability information.

The legacy download formats have been replaced by CVE JSON as the only supported format for CVE Records and downloads. See below.

This change was first announced in July 2023 in a CVE Blog article entitled “Legacy CVE Download Formats Will Be Phased Out Beginning January 1, 2024” on the CVE.ORG website and promoted throughout the remainder of 2023 in the CVE Announce email newsletter and on CVE social media. A second blog article, entitled “Deprecation of Legacy CVE Download Formats Now Underway,” was published in January 2024.

Phase-Out Schedule

Phased deprecation means that the frequency of updates to the legacy download formats will be reduced over the coming months until they are no longer updated at the end of June 2024.

To assist consumers with their transition to the new format, the frequency of updates to the legacy download formats are being reduced from daily updates (which ended on December 31, 2023) to updates on the following schedule:

New Format for CVE Records and Downloads

CVE Downloads in our new official data format for CVE Records, “CVE JSON,” are hosted in the cvelistV5 repository on GitHub.com. Update frequency and other details are available in the repository ReadMe.

CVE JSON is a richer, more structured format for vulnerability identification and description and will provide enhanced information for your customers. The schema for this new format is also available on GitHub.

Who Is Affected?

CVE Numbering Authority (CNA) partners, tool vendors, and other parties that use CVE download files for automation or other purposes should pay particular attention to this change.

Take Action Now!

Product teams and others need to update their tools and processes to the new supported format prior to these legacy format download files no longer being updated after June 30, 2024.

Please use our CVE Blog website feedback form, comment on the CVE Blog on Medium, or use the CVE Request Web forms and select “Other” from the dropdown menu, to provide feedback about this article.

Special Message for CVE Numbering Authorities (CNAs)

CNAs, please note that VulnCon 2024 takes the place of this year’s Spring CVE Global Summit.

VulnCon 2024

The CVE Program and FIRST will co-host VulnCon 2024 at the McKimmon Center in Raleigh, North Carolina, USA, on March 25–27, 2024. In-person and virtual registration is now open on this FIRST web page.

The purpose of VulnCon — which is open to the public — is to collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem. A key goal of the conference is to understand what important stakeholders and programs are doing within the vulnerability management ecosystem and best determine how to benefit the ecosystem broadly.

Registration

Registration is now open. Please note that discounted rates are not being offered for this event regardless of membership or speaking status.

• Standard Admission: US $250.00
• Virtual Admission: US $100.00

Registration fees for standard admission include three days of coffee breaks and buffet lunches, one networking reception, and applicable meeting materials.

Register now using FIRST’s Event Registration Form.

Venue

McKimmon Center
North Carolina State University
1101 Gorman St.
Raleigh, North Carolina 27606
USA

Learn More About VulnCon 2024

For most up-to-date information, visit the CVE/FIRST VulnCon 2024 conference page hosted on the FIRST website.

We look forward to seeing you at this first-ever community event and encourage you to register today!

About Tod

Tod Beardsley is employed by the U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA). He is also a founder of, and the CVE Numbering Authority (CNA) point of contact for, AHA!. He spends most of his time involved in vulnerability research and coordinated vulnerability disclosure (CVD).

Tod has over 30 years of hands-on security experience, stretching from in-band telephony switching to modern Internet of Things (IoT) implementations. He has held information technology (IT) operations, security, software engineering, and management positions in large organizations such as Rapid7, 3Com, Dell, and Westinghouse, as both an offensive and defensive practitioner.

Tod is a long-term active member of the CVE community. In addition to chairing the CNACWG and serving as CNA Board Liaison, Tod created the CNA Mentoring Program, has led or contributed to numerous CVE- and CNA-oriented workshops, and published “An Inside Look at What Makes the CVE Program Tick” on SCMagazine.

Tod has authored several research papers and hosted the Security Nation podcast. He is a Travis County Election Judge in Texas and an internationally tolerated horror fiction expert.

About the CVE Board

The CVE Board is the organization responsible for the strategic direction, governance, operational structure, policies, and rules of the CVE Program. The Board includes members from numerous cybersecurity-related organizations including commercial security tool vendors, academia, research institutions, government departments and agencies, and other prominent security experts, as well as end-users of vulnerability information.

Several years ago, it was clear to the CVE Board that we would need a specific process for the inevitable disputes that may arise around vulnerability reporting. Potential scenarios may be obvious to many, but a basic example would be when a finder reports a potential vulnerability to a vendor/maintainer that agrees a bug exists but disagrees that it’s a potential security hole.

CVE Record Dispute Policy

By publishing the “CVE Record Dispute Policy” in 2022, the CVE Program has aimed to provide an easy pathway to affected parties for disputes resolution that moves up through a CVE Numbering Authority (CNA), Root, Top-Level Root (TL-Root), and Council of Roots (CoR) hierarchy. Note that a “Root” is an organization authorized within the CVE Program that is responsible, within a specific scope, for the recruitment, training, and governance of one or more CNAs. If you are picturing a hierarchy of CNAs that enable the program to scale, then you’ve got it. Roots help new CNAs onboard and support CNAs to follow the rules of the program. When needed, a dispute may be escalated to the CNA’s Root (and upward in the hierarchy, if needed) as detailed in the CVE Record Dispute Policy.

A flow chart of the CVE Record Dispute Policy process is below. A more complete description of the process is included in the policy document here.

DISPUTED Tag Could Be Temporary or Indefinite

It is not possible in all cases for the Root, TL-Root, or CoR to establish who may be correct in such disputes (though a decision by the CoR is final). In such cases, the Program may give the CVE Record a designation of “DISPUTED.”

A “DISPUTED” tag in a CVE Record could be for one (or more) of any number of reasons, for example, questions of accuracy, completeness, or whether the bug in question is, in fact, a security hole at all.

In these instances, it is the Board’s intent — per the CVE Record Dispute Policy — that the Program:

• Will not make a determination as to which party in the dispute is correct.
• Will allow the reader to be informed of a potential vulnerability by adding the DISPUTED tag to the CVE Record in question.
• Will enable the reader (by allowing the record to remain published with the DISPUTED tag) to decide whether the disputed report represents a threat to their organization’s assets.

Recently, we have observed in public discourse some assumptions by the community that the DISPUTED tag is an interim state. However, in some cases, the DISPUTED tag may remain in place indefinitely.

The complete details of the CVE Program’s disputes policy can be found here.

Please comment here on the CVE Blog on Medium, use our CVE Blog website feedback form, or use the CVE Request Web forms and select “Other” from the dropdown menu, to provide feedback about this article.

Learn how CVE Numbering Authority (CNA) partners — ranging from large to small organizations, proprietary and open-source products or projects, disparate business sectors, and different geographic locations — are overseen and supported within the CVE Program by “Top-Level Roots” and “Roots.” Topics include the roles and responsibilities of the two different types of Roots; how their work benefits the CNAs under their care; how they recruit new CNA partners, including suggestions for addressing upper management concerns if a CNA prospect organization is hesitant to partner as a CNA; how they work with and support their CNAs over time; how the “Council of Roots” works together to enhance and help improve the program overall; and much more.

All current CVE Program Top-Level Roots and Roots are represented in this podcast. In addition to host Shannon Sabens of CrowdStrike, speakers include Julia Turkevich of the CISA Top-Level Root and CISA ICS Root, Dave Morse of the MITRE Top-Level Root, Cristian Cadenas Sarmiento of the INCIBE Root, Paul Dev of the Google Root, Tomo Ito of the JPCERT/CC Root, and Yogesh Mittal of the Red Hat Root.

The “We Speak CVE” podcast is available for free on the CVE Program Channel on YouTube, on the We Speak CVE page on Buzzsprout, and on major podcast directories such as Spotify, Stitcher, Google Podcasts, Apple Podcasts, iHeartRadio, Podcast Addict, Podchaser, Pocket Casts, Deezer, Listen Notes, Player FM, and Podcast Index, among others.

Please give the podcast a listen and let us know what you think!