Update definitions

[EvansJonathan]

GOAL: Clarify existing language.
CHANGE:
Clarify the difference between "when a vulnerability is made public" versus "when a vulnerability is added to the CVE list" and how they affect each other.
OUTCOME: Less vague or confusing language.

[EvansJonathan]

Discussion of "when a vulnerability is made public" can be found in sections:

• 2.1.1
• 2.2.6
• 2.2.7
• 4.1.3
• INC2

[EvansJonathan]

I could not find a discussion of "when a vulnerability is added to the CVE list" in the CNA Rules.

[EvansJonathan]

I have been using the following criteria to for "when a vulnerability is public" when I train new CNAs. The criteria is based on the required information in Appendix B and MITRE's requirement that any information in a CVE entry be made public elsewhere first (See #26).

• For a vulnerability to be considered public meet the following conditions
  • Has to have a URL
  • The Terms of the website must allow the CVE List to link to the URL
  • The document linked to by the URL must contain the minimum required information for a CVE entry.
    • Product
    • Version
    • Problem type (vulnerability type or impact)
• Registration and login requirements are acceptable, but there can’t be other restrictions
• Advisories that require payment to access are not considered public
  • If you have a public advisory with the minimum required details and other details require payment to access, then the vulnerability is considered public

[dadinolfi]

To be added to section 2.1.1 after the existing content:

Note: for a vulnerability to be considered "public", the following conditions must be met:

• There must be a URL including information about the vulnerability accessible from the internet.
• The Terms of Use of the website must allow the CVE List to link to the URL.
• The document linked by the URL must contain the minimum required information for a CVE Entry (see Appendix B).

Registration and login requirements are acceptable, but there cannot be other restrictions for accessing that content. Also, advisories that require payment for access are not considered public. That said, if you have a public advisory with the minimum required details with additional details available through paid access, the vulnerability is still considered public.

[dadinolfi]

Updated CNA Rules draft.