CVE 相關資訊統整

type

status

date

slug

summary

什麼是 CVE 與發現的過程

CVE，全名是 Common Vulnerabilities and Exposures（常見漏洞與暴露），是一個公開的漏洞和資訊安全風險列表。它提供了一個唯一的識別器給每個已知的安全漏洞，以便於安全專家和系統管理員能準確、清晰地交流和分享資訊。CVE 列表由美國的 MITRE 公司維護，並得到美國國土安全局 (Department of Homeland Security) 的支持。

每個 CVE 條目包含一個唯一的識別號碼，通常被稱為 CVE ID，以及與該漏洞相關的基本資訊。每個 CVE ID 都會提供足夠的資訊，以便於識別相關的漏洞，並能在不同的資訊安全工具和服務中進行參考。

CVE被發現的過程

Discover 如字面上，就有『人』漏洞

Report 『人』把這個漏洞報告給『 CVE Program participant』

Request 『 CVE Program participant』幫『CVE』請求一個 ID

Reserve ID 被保存下來

Submit 把這個CVE的細節描述上去

Publish 公開給你所～有～想要知道 CVE 的朋友

CVE ID

基本上是隨機分配的，只是分成好幾個部分，並且是由 sub-CNA 去分發的，並且越新的後三位數字越大

原文

A CVE ID is a unique, alphanumeric identifier assigned by the CVE Program. Each identifier references a specific vulnerability.

CVE IDs have the following format:

CVE prefix + Year + Arbitrary Digits

The “Year” portion is the year that the CVE ID was reserved or the year the vulnerability was made public. The year portion is not used to indicate when the vulnerability was discovered.

The “Arbitrary Digits,” or sequence number portion, can include four or more digits in the sequence number portion of the ID. For example, CVE-YYYY-NNNN with four digits in the sequence number, CVE-YYYY-NNNNNNN with seven digits in the sequence number, etc. There is no limit on the number of arbitrary digits.

The CVE Program’s CNA Rules include additional helpful information about CVE IDs:

Assignment Rules - how CVE IDs are assigned.

CVE Recode

一個 CVE Record 指的是一個 CVE 紀錄裡面，具體上要包含什麼樣的資訊，通常就是一段描述（最精華的部分），並且要加上必要的 reference。

另外 CVE 還有一些狀態，以下的 toggle 有詳細的紀錄，有興趣可以查閱

原文

A CVE Record is the descriptive data about a vulnerability associated with a CVE ID, provided by a CVE Numbering Authority (CNA). This data is provided in multiple human and machine-readable formats.

Each CVE Record includes the following:

CVE ID with four or more digits in the sequence number portion of the ID (i.e., “CVE-1999-0067”, “CVE-2019-12345”, “CVE-2021-7654321”).

Brief description of the security vulnerability.

Any pertinent references (i.e., vulnerability reports and advisories).

A CVE Record is associated with one of the following states:

Reserved: The initial state for a CVE Record; when the associated CVE ID is Reserved by a CNA.

Published: When a CNA populates the data associated with a CVE ID as a CVE Record, the state of the CVE Record is Published. The associated data must contain an identification number (CVE ID), a prose description, and at least one public reference.

Rejected: If the CVE ID and associated CVE Record should no longer be used, the CVE Record is placed in the Rejected state. A Rejected CVE Record remains on the CVE List so that users can know when it is invalid.

The CVE Program’s CNA Rules include additional helpful information about CVE Records: