cve-cna-open-letter.txt

An open letter to the CVE Project and CNAs
==========================================

Security and vulnerability handling in software is of ever increasing
importance. Recent events have adversely affected many project's ability
to identify and ensure these issues are addressed in a timely manner.
This is extremely worrying.

Most realistic ways of using CVE data involve a machine readable way of
knowing which software component is affected and which versions. Until
recently many of us were relying not on the CVE project's data but on
the NVD data that added that information.

The CVE JSON version 5 format
(https://cveproject.github.io/cve-schema/schema/v5.0/docs/) is a significant
improvement as it includes product and vendor names directly, and supports
version constraints although they are not mandatory.

We would like to ask that:

* machine readable affected version ranges become strongly encouraged
  (ideally mandatory) for new CVEs

* it becomes easy for CNAs to update older CVEs to include the machine
  readable product and vendor names and add version information

* CNAs make sure they follow the same format when entering the machine
  readable data, so that consumers can create programs handling this
  data in an unified way

Current collection forms do not require version information and the
importance of it is easily overlooked. They could warn if it isn’t present
for example.

For older CVEs in particular there is a wealth of version information in
NIST’s NVD. Finding a way to extend older CVE entries with this (and other)
information would help everyone.

Processes/tooling to easily allow CNAs to adopt enhancements to CVEs would
also encourage improving the data, ideally as easy as something like a
GitHub pull request.

We, as projects that need to respond to security issues, could all do things
in our own ways. Many of us have open source backgrounds and realise the
power of collaboration and would much prefer to work together and build
something none of us alone could achieve. We need the tools, processes
and core support from the CVE project to make it happen.

In order to show the level of support for this, this 'open letter' is being
shared around between projects and we're accepting pull requests to add
signatures from both individuals and suitable project/company representatives.


Signed:

Richard Purdie <richard.purdie@linuxfoundation.org>
(Yocto Project Architect, TSC Chair and Linux Foundation Fellow)
on behalf of Yocto Project and OpenEmbedded



Ross Burton <ross.burton@arm.com>
Yocto Project TSC member, Arm Ltd



Marta Rybczynska <rybczynska@gmail.com>
Yocto Project Security Team Member
also signed "An Open Letter from Cybersecurity Professionals to the U.S. Congress and Secretary of Commerce
A cybersecurity crisis in waiting: On the Need to Restore and Enhance Operations with the National Vulnerability Database"
https://docs.google.com/document/d/1y6JXhh52b1OMxLMQyl_WH0R2-85iYEBzjSm_fhv8-GY/edit


Alex Stewart <alex.stewart@ni.com>
Lead Distro Maintainer, NI LinuxRT
NI, Emerson Electric



Jerome Oufella <jerome.oufella@savoirfairelinux.com>
VP Technologies, Savoir-faire Linux, Inc.



Maxin John <maxin.john@gehealthcare.com>
Software Engineer, GE Healthcare Finland Oy



Thomas Roos <throos@amazon.de>
meta-aws, yocto, embedded linux @ AWS



Ricardo Salveti <ricardo@foundries.io>
Principal Engineer, Foundries.io



Thomas Rini <trini@konsulko.com>
Chief Custodian of Das U-Boot, VP of Engineering at Konsulko Group



Esben Haabendal <esben@geanix.com>
Director, Geanix ApS



Jose Quaresma <jose.quaresma@foundries.io>
Embedded Linux Engineer, Foundries.io



Alexander Kanavin <alex@linutronix.de>
Yocto contributor, openembedded-core maintainer (one of)



Trevor Gamblin <tgamblin@baylibre.com>
Yocto contributor, Patchtest maintainer



Louis Rannou <louson@gresille.org>
Yocto Project contributor, Syslinbit



Leonardo Held <leonardo.held@toradex.com>
Embedded Linux Engineer, Toradex



Yoann Congal <yoann.congal@smile.fr>
Yocto Project contributor, Tech expert @ Smile ECS



Thomas Perrot <thomas.perrot@bootlin.com>
Embedded Linux Engineer, Bootlin



Adrian Freihofer <adrian.freihofer@siemens.com>
Embedded Linux Engineer, Siemens



Matthias Klein <matthias.klein@optimeas.de>
Embedded Linux Engineer, optiMEAS



Fabien Lehoussel <fabien.lehoussel@smile.fr>
Tech Manager @ Smile ECS



Vincent Jourdon <vincent.jourdon@smile.fr>
COO Embedded Software @ Smile ECS



Piotr Buliński <piotr@c89.tech>
Security Solutions Architect, C89



Paul Goulpié <paul.goulpie@smile.fr>
Tech expert @ Smile ECS


Ayoub Zaki <ayoub.zaki@embetrix.com>
Principal Consultant Owner, Embetrix Embedded Systems Solutions



Daiane Angolini <daiane.angolini@foundries.io>
Embedded Linux Engineer, Foundries.io



Sreejith Naarakathil <sreejith.naarakathil@gnusfaas.com>
Chief Evangelist, GNUSFAAS AB



Fabien Thomas <fabien.thomas@smile.fr>
Tech Manager @ Smile ECS



Jérémy Rosen <jeremy.rosen@smile.fr>
CTO Embedded Software @ Smile ECS



Łukasz Piłatowski <lukasz@hivecv.com>
CTO @ HiveCV



Fabien Lahoudere <fabienlahoudere.pro@gmail.com>
Embedded Linux practice leader, Technology and strategy



Mauro Salvini <mauro.salvini@gmail.com>
Embedded Linux engineer, freelance



Jaeyoon Jung <jaeyoon.jung@lge.com)
Research fellow, LG Electronics



Andreas Schirm <andreas.schirm@siemens.com>
Principal Key Expert, Siemens



Marcel Henkel <marcel.hm.henkel@bmw.de>
Vulnerability Manager Product, BMW AG



Joakim Bech <joakim.bech@linaro.org>
Distinguished Engineer, Linaro Limited



Chuck Wolber <chuck.wolber@boeing.com>
Associate Technical Fellow, The Boeing Company



Alex Gonzalez <alexg@balena.io>
OS lead, Balena Ltd.



Andrew Pollock <apollock@google.com>
Software Engineer, Google Open Source Security Team



Linda Wang <Linda.Wang@WindRiver.com>
Director of Engineer, Wind River Inc./Aptiv Inc.



Stefan Schmidt <stefan.schmidt@huawei.com>
Principal Solutions Architect Open Source, Huawei


Christophe Priouzeau <christophe.priouzeau@foss.st.com>
Software Engineer, STMicroelectronics


Geoff Parker <geoffrey.parker@arthrex.com>
Software Engineer, Arthrex, Inc.



Ryan Jones <ryan.jones2@arthrex.com>
Product Security, Arthrex, Inc.



Cliff Brake <cbrake@bec-systems.com>
E-Linux/IoT Consultant, Platform Thinker, BEC Systems, LLC.



[please separate signatures with 3 empty lines and leave 3 empty lines above this
text after the signature to make git merge conflicts easier]