Revising the CVE CNA Operational Rules: AMA
summary
A year-long rewrite nearly finishes: the CNA Operational Rules are almost entirely new, not just edited. The rules codify a first refusal for the supplier CNA but allow a CNR or other CNA to assign after a 72-hour timer, and a public disclosure with “public sufficient evidence” triggers assignment. The board aims for an April vote, a 90‑day rollout for CNAs, a $5,000 effort threshold to stop endless debates, and explicit dispute/duplicate handling and CNR cleanup paths.
AI-written summary · about
chapters (26)
- 0:00CVE CNA rules revision AMA
- 1:02Challenges in rules revision
- 3:07Key challenges in revision
- 6:15Right of first refusal debates
- 10:14CVE ID assignment rules
- 14:09Right of first refusal explained
- 15:36Revised CVE assignment rules
- 22:03Rules revision timeline
- 24:27Enforcement and consequences
- 26:56Trademark vs rule violations
- 30:12CNA incentives and benefits
- 33:23CVE IDs and liability
- 35:1072-hour assignment period
- 37:19Excluded contentious areas
- 39:28Avoiding duplicate CVEs
- 40:54Independently fixable vulnerabilities
- 43:23Disputed CVE assignments
- 45:51Future rule updates
- 46:34Required CVE ID elements
- 49:03Rejecting non-vulnerabilities
- 50:04Public comments on draft rules
- 50:47Ripple effects on CVE rules
- 52:11End-of-life software scope
- 53:56Physical vs cyber vulnerabilities
- 56:03Dispute resolution hierarchy
- 57:46Summary and closing
related talks
54mNo Action Required: CVE for Software as a Service
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
45mFuture of CVE
51mAutomating CNA CVE Reporting and Monthly Bulletins
38mThe Enriched CVE Record: Redefining Completeness and Quality for Greater Impact
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem