1. {{Anchor|IDENTIFIERS}}CVE identifiers

2. CVE data fields
    Description  References  Date entry created  Obsolete fields 

3. Changes to syntax

4. CVE SPLIT and MERGE

5. Search CVE identifiers

6. CVE usage

7. See also

8. References

9. External links

The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures. The National Cybersecurity FFRDC, operated by the Mitre Corporation, maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland Security.^[1]

The Security Content Automation Protocol uses CVE, and CVE IDs are listed on MITRE's system^[2] as well as in the US National Vulnerability Database.

{{Anchor|IDENTIFIERS}}CVE identifiers

MITRE Corporation's documentation defines CVE Identifiers (also called "CVE names", "CVE numbers", "CVE-IDs", and "CVEs") as unique, common identifiers for publicly known information-security vulnerabilities in publicly released software packages. Historically, CVE identifiers had a status of "candidate" ("CAN-") and could then be promoted to entries ("CVE-"), however this practice was ended some time ago and all identifiers are now assigned as CVEs. The assignment of a CVE number is not a guarantee that it will become an official CVE entry (e.g. a CVE may be improperly assigned to an issue which is not a security vulnerability, or which duplicates an existing entry).

CVEs are assigned by a CVE Numbering Authority (CNA);^[3] there are three primary types of CVE number assignments:

1. The Mitre Corporation functions as Editor and Primary CNA
2. Various CNAs assign CVE numbers for their own products (e.g. Microsoft, Oracle, HP, Red Hat, etc.)
3. A third-party coordinator such as CERT Coordination Center may assign CVE numbers for products not covered by other CNAs

When investigating a vulnerability or potential vulnerability it helps to acquire a CVE number early on. CVE numbers may not appear in the MITRE or NVD CVE databases for some time (days, weeks, months or potentially years) due to issues that are embargoed (the CVE number has been assigned but the issue has not been made public), or in cases where the entry is not researched and written up by MITRE due to resource issues. The benefit of early CVE candidacy is that all future correspondence can refer to the CVE number. Information on getting CVE identifiers for issues with open source projects is available from Red Hat.^[4]

CVEs are for software that has been publicly released; this can include betas and other pre-release versions if they are widely used. Commercial software is included in the "publicly released" category, however custom-built software that is not distributed would generally not be given a CVE. Additionally services (e.g. a Web-based email provider) are not assigned CVEs for vulnerabilities found in the service (e.g. an XSS vulnerability) unless the issue exists in an underlying software product that is publicly distributed.

CVE data fields

The CVE database contains several fields:

Description

This is a standardized text description of the issue(s). One common entry is:

This means that the entry number has been reserved by Mitre for an issue or a CNA has reserved the number. So in the case where a CNA requests a block of CVE numbers in advance (e.g. Red Hat currently requests CVEs in blocks of 500), the CVE number will be marked as reserved even though the CVE itself may not be assigned by the CNA for some time. Until the CVE is assigned AND Mitre is made aware of it (i.e., the embargo passes and the issue is made public), AND Mitre has researched the issue and written a description of it, entries will show up as "**RESERVED **".

References

This is a list of URLs and other information (such as vendor advisory numbers) for this issue.

Date entry created

This is the date the entry was created. For CVEs assigned directly by Mitre, this is the date Mitre created the CVE entry. For CVEs assigned by CNAs (e.g. Microsoft, Oracle, HP, Red Hat, etc.) this is also the date the entry was create by Mitre, not by the CNA. So in the case where a CNA requests a block of CVE numbers in advance (e.g. Red Hat currently requests CVEs in blocks of 500) the entry date would be when that CVE is assigned to the CNA. The CVE itself may not be used for days, weeks, months or even possibly years (e.g. Red Hat maintains blocks of CVEs for older security issues in open-source software that were not assigned CVEs yet).

Obsolete fields

The following fields were previously used in older CVE records, but are no longer used.

• Phase: The phase the CVE is in (e.g. CAN, CVE).
• Votes: Previously board members would vote yea or nay on whether or not the CAN should be accepted and turned into a CVE.
• Comments: Comments on the issue.
• Proposed: When the issue was first proposed.

Changes to syntax

In order to support CVE ID's beyond CVE-YEAR-9999 (aka the CVE10k problem) a change was made to the CVE syntax in 2014 and took effect on Jan 13, 2015. ^[5]

The new CVE-ID syntax is variable length and includes:

CVE prefix + Year + Arbitrary Digits

NOTE: The variable length arbitrary digits will begin at four (4) fixed digits and expand with arbitrary digits only when needed in a calendar year, for example, CVE-YYYY-NNNN and if needed CVE-YYYY-NNNNN, CVE-YYYY-NNNNNN, and so on. This also means there will be no changes needed to previously assigned CVE-IDs, which all include a minimum of 4 digits.

CVE SPLIT and MERGE

CVE attempts to assign one CVE per security issue, however in many cases this would lead to an extremely large number of CVEs (e.g. where several dozen cross-site scripting vulnerabilities are found in a PHP application due to lack of use of htmlspecialchars() or the insecure creation of files in /tmp). To deal with this there are guidelines (subject to change) that cover the splitting and merging of issues into distinct CVE numbers. As a general guideline one should first consider issues to be merged, then issues should be split by the type of vulnerability (e.g. buffer overflow vs. stack overflow), then by the software version affected (e.g. if one issue affects version 1.3.4 through 2.5.4 and the other affects 1.3.4 through 2.5.8 they would be SPLIT) and then by the reporter of the issue (e.g. Alice reports one issue and Bob reports another issue the issues would be SPLIT into separate CVE numbers). Another example is Alice reports a /tmp file creation vulnerability in version 1.2.3 and earlier of ExampleSoft web browser, in addition to this issue several other /tmp file creation issues are found, in some cases this may be considered as two reporters (and thus SPLIT into two separate CVEs, or if Alice works for ExampleSoft and an ExampleSoft internal team finds the rest it may be MERGE'ed into a single CVE). Conversely issues can be merged, e.g. if Bob finds 145 XSS vulnerabilities in ExamplePlugin for ExampleFrameWork regardless of the versions affected and so on they may be merged into a single CVE.^[6]

Search CVE identifiers

The Mitre CVE database can be searched at the [https://cve.mitre.org/cve/search_cve_list.html CVE List Search], and the NVD CVE database can be searched at [https://web.nvd.nist.gov/view/vuln/search Search CVE and CCE Vulnerability Database].

CVE usage

CVE identifiers are intended for use with respect to identifying vulnerabilities:

Common Vulnerabilities and Exposures (CVE) is a dictionary of common names (i.e., CVE Identifiers) for publicly known information security vulnerabilities. CVE’s common identifiers make it easier to share data across separate network security databases and tools, and provide a baseline for evaluating the coverage of an organization’s security tools. If a report from one of your security tools incorporates CVE Identifiers, you may then quickly and accurately access fix information in one or more separate CVE-compatible databases to remediate the problem.^[7]

Users who have been assigned a CVE identifier for a vulnerability are encouraged to ensure that they place the identifier in any related security reports, web pages, emails, and so on.

See also

• Common Vulnerability Scoring System (CVSS)
• Common Weakness Enumeration (CWE)

References

External links

• {{Official website}}
• [https://nvd.nist.gov/ National Vulnerability Database (NVD)]
• [https://nvd.nist.gov/cce/index.cfm Common Configuration Enumeration (CCE)] at NVD
• [https://github.com/toolswatch/vFeed vFeed] the Correlated and Aggregated Vulnerability Database - SQLite Database and Python API
• [https://www.cyberwatch.fr/en/vulnerabilities Cyberwatch Vulnerabilities Database], third party
• [https://people.redhat.com/kseifrie/CVE-OpenSource-Request-HOWTO.html CVE OpenSource Request HOWTO]

• Through The Fire And The Flames
• Through the Fire and the Flames
• Through the Fire (Chaka Khan song)
• Through the Fire (disambiguation)
• Through the fire (film)
• Through the Flames
• Through The Forest
• Through the Forest
• Through the Forests and Through the Trees
• Through the Glass
• Through the Hidden Door
• Through The Iris
• Through the Iris
• Through the key hole
• Through the Long Days
• Through The Looking Glass (album)
• Through the Looking Glass and What Alice Found There
• Through the Looking-Glass, and What Alice Found There
• Through the Looking Glass (Angel episode)
• Through the Looking-Glass (disambiguation)
• Through The Looking Glass (Dom and Roland album)
• Through the Looking Glass (Dom & Roland album)
• Through the Looking Glass (Farscape)
• Through the Looking-Glass (opera)
• Through the Looking Glass (opera)