CNA Feedback Session to the CVE Program
summary
Room discussion focuses on operational details: CVE Services is in community testing with a 30‑day window and planned deployment in late April; the new record format 5.1 adds CVSS v4 support and tightens schema rules; on‑demand API calls give instant CVE IDs and publishing in ~15 minutes. Onboarding needs about one hour of formal training, roughly 4–8 hours work per CV plus a few hours/month maintenance; ADP is planned (ADP coming early summer) to separate Secretariat additions; QWG handles data quality and there is no standardized CNA SLA today.
AI-written summary · about
chapters (17)
- 0:00CNA feedback session intro
- 1:25Advantages of CNA
- 4:40CV Services 5.1 update
- 8:10CNA onboarding requirements
- 14:33CNA peer support programs
- 16:17GitHub submissions to CV Services
- 17:41CVE ID allocation process
- 23:24CNA rules update
- 26:15Inconsistent CNA response times
- 31:33Unauthorized references in CVE
- 35:04CVE biggest challenges
- 39:38Non-CNA consumer feedback
- 40:21Tracking reserved CVE IDs
- 44:38Improving CVE data quality
- 46:43CNA rules enforcement
- 49:08Joining CVE working groups
- 51:58Closing remarks
related talks
45mFuture of CVE
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
56mCISA’s North Star Vision for the CVE Program
51mAutomating CNA CVE Reporting and Monthly Bulletins
54mNo Action Required: CVE for Software as a Service
30mVulnrichment: Year One