CVE Decaf: Brewing Better and More Actionable Data Quality
summary
Introduces a practical Data Quality Assessment Framework that separates schema limits from how CNAs populate fields, classifying issues as population gap, design gap or ecosystem constraints. Reports concrete findings: about 28% of recent CVEs include machine-identifiers (27.9% CPE, only a handful of PEARL), 58% of CPE strings omit version, workarounds appear in <1% of recent records, and many CVEs lack patch metadata despite Microsoft now populating the patch field. Draft paper and GitHub org (CVE-DQAF) provide tests and next steps.
AI-written summary · about
chapters (20)
- 0:00CVE data quality challenges
- 2:52Data quality in product management
- 4:16Data quality frameworks
- 7:23CVE records as a product
- 8:25Consumer personas for CVE data
- 10:37Vulnerability management tasks
- 12:43Identification task gaps
- 13:24Characterization task rules
- 14:24Remediation task info
- 15:31Prioritization task needs
- 16:54CVE record gaps
- 18:19Identification data gaps
- 20:48Characterization data gaps
- 22:12Remediation data gaps
- 23:16Next steps and working group
- 24:19Automation test challenges
- 25:27Q&A on governance
- 26:53Automation versus analyst needs
- 29:18CVE design evolution
- 32:27Summary
related talks
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
30mThe Growing Crisis in CVE Data Quality
38mThe Enriched CVE Record: Redefining Completeness and Quality for Greater Impact
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
45mFuture of CVE
01h 51mOpen Interchange on CPE - Purl Between Communities of Interest and the CVE and NVD Programs
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
26mWhere Do We Aim? A Look at the State of Vulnerable Software Identification and Its Future