MITRE's bug pilot program fix 'indefinitely' shelved amid criticism

Lack of consultation fingered for CVE allocation disaster


A pilot project launched by vulnerability handler MITRE to address stagnation in the assignment of bug identification numbers has been shelved less than a day after its announcement and before its scheduled launch today.

The pilot was devised in response to complaints by security researchers and MITRE board members about the stalled allocation of CVE numbers.

As detailed by The Register, dozens of security researchers have struggled to gain Common Vulnerabilities and Exposures (CVE) numbers for their discovered vulnerabilities in what they say impacts broader security.

The MITRE website now bears a warning to visitors that it is experiencing "unprecedented demand for vulnerability IDs" and that it will work with the editorial board for a solution.

The pilot was rapidly spun up as a fix to address gaps in the CVE allocation scheme by accelerating the issuance of numbers under a revised naming schema planned to run in parallel with CVE.

It received swift criticism on grounds it was developed without consultation and would confuse the market, break existing tools, and ultimately fail to speed up allocation.

Mitre will hold an editorial meeting to discuss the future of the CVE system. The Register understands an announcement is due within a week but just what any new scheme will offer is unknown.

MITRE CVE communications and adoption lead Joe Sain said the pilot would be placed on "indefinite hold".

"A number of concerns with the proposed syntax were raised, and we heard them clearly ...we will not move forward with a public announcement of the pilot plan, which we are putting on indefinite hold," Sain says.

"The pilot described yesterday was designed to run in parallel and to be completely separate from the production CVE stream, but we certainly understand the importance of not perturbing any operating aspect of CVE.

"... we are looking forward to developing an operating model that enables CVE to move forward and that preserves the foundational work that the community has put into the effort."

MITRE editorial board members were quick to criticise the pilot federated platform. Kent Landfield also of Intel said the pilot "breaks just about everything" adding his earlier suggestion that a federated platform be considered should have been developed with the board.

"... I and others that have operational responsibility for using and distributing CVEs [thought we] would have some say in what it looked like," Landfield says.

"It would be in the best interest to hold off in my mind since these (pilots) IDs have no usefulness in product and this will totally confuse the market, researchers, and those with operational needs for a consistent CVE."

The remarks are echoed by another board member Kurt Seifried, of RedHat, who says he has struggled to push for an overhaul of the CVE system.


Other stories you might like

  • James Webb Space Telescope has arrived at its new home – an orbit almost a million miles from Earth

    Funnily enough, that's where we want to be right now, too

    The James Webb Space Telescope, the largest and most complex space observatory built by NASA, has reached its final destination: L2, the second Sun-Earth Lagrange point, an orbit located about a million miles away.

    Mission control sent instructions to fire the telescope's thrusters at 1400 EST (1900 UTC) on Monday. The small boost increased its speed by about 3.6 miles per hour to send it to L2, where it will orbit the Sun in line with Earth for the foreseeable future. It takes about 180 days to complete an L2 orbit, Amber Straughn, deputy project scientist for Webb Science Communications at NASA's Goddard Space Flight Center, said during a live briefing.

    "Webb, welcome home!" blurted NASA's Administrator Bill Nelson. "Congratulations to the team for all of their hard work ensuring Webb's safe arrival at L2 today. We're one step closer to uncovering the mysteries of the universe. And I can't wait to see Webb's first new views of the universe this summer."

    Continue reading
  • LG promises to make home appliance software upgradeable to take on new tasks

    Kids: empty the dishwasher! We can’t, Dad, it’s updating its OS to handle baked on grime from winter curries

    As the right to repair movement gathers pace, Korea’s LG has decided to make sure that its whitegoods can be upgraded.

    The company today announced a scheme called “Evolving Appliances For You.”

    The plan is sketchy: LG has outlined a scenario in which a customer who moves to a locale with climate markedly different to their previous home could use LG’s ThingQ app to upgrade their clothes dryer with new software that makes the appliance better suited to prevailing conditions and to the kind of fabrics you’d wear in a hotter or colder climes. The drier could also get new hardware to handle its new location. An image distributed by LG shows off the ability to change the tune a dryer plays after it finishes a load.

    Continue reading
  • IBM confirms new mainframe to arrive ‘late’ in first half of 2022

    Hybrid cloud is Big Blue's big bet, but big iron is predicted to bring a welcome revenue boost

    IBM has confirmed that a new model of its Z Series mainframes will arrive “late in the first half” of 2022 and emphasised the new device’s debut as a source of improved revenue for the company’s infrastructure business.

    CFO James Kavanaugh put the release on the roadmap during Big Blue’s Q4 2021 earnings call on Monday. The CFO suggested the new release will make a positive impact on IBM’s revenue, which came in at $16.7 billion for the quarter and $57.35bn for the year. The Q4 number was up 6.5 per cent year on year, the annual number was a $2.2bn jump.

    Kavanaugh mentioned the mainframe because revenue from the big iron was down four points in the quarter, a dip that Big Blue attributed to the fact that its last mainframe – the Z15 – emerged in 2019 and the sales cycle has naturally ebbed after eleven quarters of sales. But what a sales cycle it was: IBM says the Z15 has done better than its predecessor and seen shipments that can power more MIPS (Millions of Instructions Per Second) than in any previous program in the company’s history*.

    Continue reading

Biting the hand that feeds IT © 1998–2022