CVE Identifiers: Standardizing Public Software Vulnerabilities
In the complex landscape of cybersecurity, maintaining a clear and consistent way to track security flaws is essential. CVE Identifiers (also known as CVE IDs, CVE numbers, or CVE names) serve as the industry standard for uniquely identifying publicly known information-security vulnerabilities within software packages that have been released to the public.
Managed by the MITRE Corporation, this system ensures that security professionals, vendors, and researchers are all talking about the same issue when they reference a specific vulnerability, eliminating confusion across different databases and tools.
Key Facts
- CVEs provide unique identifiers for publicly known software vulnerabilities.
- The MITRE Corporation acts as the Editor and Primary CVE Numbering Authority (CNA).
- Not every assigned CVE number becomes an official entry; some are rejected if they are duplicates or not actual security vulnerabilities.
- CVEs apply to publicly released software, including commercial products and widely used betas.
- The "candidate" (CAN-) status was phased out in 2005 in favor of direct CVE assignment.
How CVEs are Assigned
The process of assigning a CVE is handled by a CVE Numbering Authority (CNA). While the formal designation of a CNA was established on February 1, 2005, the practice of assigning these identifiers has evolved through four primary channels:
- MITRE Corporation: Functions as the primary CNA and the overall editor of the system.
- Product Vendors: Major companies such as Microsoft, Oracle, HP, and Red Hat assign CVEs for their own specific products.
- Third-Party Coordinators: Organizations like the CERT Coordination Center assign IDs for products not covered by other CNAs.
- Researchers: In specific instances, individual researchers have been granted the CNA role.
The Lifecycle and Scope of a CVE
Acquiring a CVE number early in the investigation of a potential vulnerability is highly beneficial. It provides a common reference point for all future correspondence and coordination between parties.
However, a CVE number may not appear immediately in the MITRE or National Vulnerability Database (NVD). This delay can last from days to years due to embargoes—where a number is assigned but the details are kept private until a patch is ready—or due to resource constraints at MITRE during the research and write-up phase.
[ไม่มีภาพประกอบ]
What Qualifies for a CVE?
To receive a CVE, the software must be publicly released. This includes commercial software and pre-release versions (like betas) if they have wide usage. Historically, custom-built software that is not distributed to the public does not qualify.
The treatment of services (such as web-based email providers) has shifted over time. For the first twenty years, vulnerabilities in a service (e.g., Cross-Site Scripting or XSS) were only assigned CVEs if the flaw existed in an underlying, publicly distributed software product. While official rules on this change haven't been published, some CNAs, including MITRE, began assigning CVEs to service-based vulnerabilities as early as 2000.
| Category | Details |
|---|---|
| Primary Authority | MITRE Corporation |
| Eligible Software | Publicly released, commercial, and widely used betas |
| Ineligible Software | Custom-built, non-distributed software |
| Assignment Types | Primary CNA, Vendors, Third-party coordinators, Selected researchers |
| Possible Statuses | Assigned, Official Entry, or REJECTED |
Frequently Asked Questions
Does a CVE number guarantee that a vulnerability is official?
No. An assigned CVE number is not a guarantee of an official entry. If MITRE or a CNA determines that the issue is not a security vulnerability or is a duplicate of an existing entry, the status can be changed to REJECTED.
Why can't I find a recently assigned CVE in the NVD database?
This is often due to an embargo, meaning the vulnerability is known and assigned a number, but the information is not yet public. It could also be due to resource limitations at MITRE regarding the research and documentation of the entry.
Can a web service vulnerability get a CVE?
Yes. While historically CVEs were reserved for distributed software, some CNAs have been assigning them to service-based vulnerabilities since 2000, though official published rules on this transition are limited.
What happened to "CAN" identifiers?
Historically, identifiers started as "candidates" (CAN-) before being promoted to "CVE-". This practice ended in 2005, and all identifiers are now assigned as CVEs from the start.
How can open source projects get CVE identifiers?
Information and guidance for obtaining CVE identifiers for open source projects are available through platforms like GitHub and organizations like Red Hat.