Let’s Talk About Fitness for Purpose: Comparing and Contrasting the CVE List with OSV.dev
summary
Automated conversion from the NVD to OSV produces commit‑level metadata for C/C++ and sustains a consistent conversion rate; OSV.dev aggregates 82,000 records (2024) versus the CVE list's ~37,000, and almost 15% missing affected data in CVE impacted-field checks. OSV enforces a JSON schema and is adding an OSV schema + linter to reject imprecise records; recommended fixes include schema‑enforced minimums, targeting the top 15 CNAs first, and measuring machine‑readable completeness.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 4:19Purpose of vulnerability metadata
- 7:09OSV.dev overview
- 9:56Scale challenges in vulnerability management
- 14:55Theory versus machine readability
- 17:23Inconsistent CVE formats
- 20:13CISA pledge and compliance
- 22:43OSV data quality
- 25:10Misaligned CNA incentives
- 30:08CVE lifecycle and incentives
- 36:49Improving CVE program
- 41:03Call to action
- 41:45Q&A
related talks
53mThe Trials and Tribulations of Bulk Converting CVEs to OSV
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
30mThe Growing Crisis in CVE Data Quality
42mNavigating the Sea of CVEs: Securing Your Linux Distributions
41mScalable Management of Vulnerabilities in Open Source
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)