Panel: CVE Record Disputes Discussion: Policy, Process, and Opportunities for Improvement
summary
Panel explains why CVE records get an explicit disputed tag and how the policy enforces a 3-day acknowledgement / 5-day decision timeline with escalation after 15 days, yet many disputes persist. Program scale causes pain: roughly ~85 disputed records/year versus thousands of CVEs, vendors handle ~50k reports to ~1k CVEs, and dispute fallout reaches KEV and scanners. Practical fixes discussed include reproducible reports, richer context in machine-readable VEX, and more community participation.
AI-written summary · about
chapters (17)
- 0:00CVE record disputes panel
- 1:27Panelists' roles
- 3:57CVE dispute policy origins
- 7:54How to file a dispute
- 9:18Why disputes persist
- 13:08Vendor challenges
- 15:32Researcher dispute challenges
- 21:30Disputes at assignment stage
- 24:17Open source dispute issues
- 28:08Vendor escalation approach
- 31:16Compliance with disputed CVEs
- 35:08ZDI dispute prevention
- 37:57CVE policy refinements
- 40:05CVE program feedback sought
- 43:14Q&A on disputes
- 47:44Do disputed tags attract attackers
- 50:54Final takeaways
related talks
57mPanel Discussion: This One Time at CVD Camp
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
30mThe Growing Crisis in CVE Data Quality
30mVulnrichment: Year One
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
01mEvolution of CVEs and Vulnerability Management