diff --git a/src/views/About/Process.vue b/src/views/About/Process.vue index 33f1e9dc..39a4d852 100644 --- a/src/views/About/Process.vue +++ b/src/views/About/Process.vue @@ -6,12 +6,14 @@

Process

- There is one CVE Record for each vulnerability on - the CVE List. Vulnerabilities are first - discovered, then reported to the CVE Program. The reporter requests a + There is one + CVE Record + for each vulnerability on the + CVE List. + Vulnerabilities are first discovered, then reported to the CVE Program. The reporter requests a CVE ID, - which is then reserved for the reported vulnerability. Once the reported vulnerability is - confirmed by the identification of the minimum required data elements for a CVE Record, the record is published to the CVE List. + which is then reserved for the reported vulnerability. Once the reported vulnerability is confirmed by the + identification of the minimum required data elements for a CVE Record, the record is published to the CVE List. CVE Records are published by CVE Program partners from around the world. This process is described below.

@@ -38,8 +40,9 @@
2

Report

-

Discoverer reports a vulnerability to a - CVE Program participant. +

+ Discoverer reports a vulnerability to a + CVE Program partner.

@@ -47,7 +50,7 @@
3

Request

-

CVE Program participant requests a CVE Identifier (CVE ID).

+

CVE Program partner assigns a CVE Identifier (CVE ID).

@@ -77,16 +80,28 @@ portion is not used to indicate when the vulnerability was discovered.

- The “Arbitrary Digits,” or sequence number portion, can include four or more digits in the sequence number portion of the - ID. For example, CVE-YYYY-NNNN with four digits in the sequence number, + The “Arbitrary Digits,” or sequence number portion, can include four or more digits in the sequence number portion of + the ID. For example, CVE-YYYY-NNNN with four digits in the sequence number, CVE-YYYY-NNNNNNN with seven digits in the sequence number, etc. There is no limit on the number of arbitrary digits.

-

The CVE Program’s CNA Rules include additional helpful information about CVE IDs:

- Assignment Rules - - how CVE IDs are assigned. + The CVE Program’s + CNA Rules + include additional helpful information about CVE IDs:

+
    +
  • + + Vulnerability Determination + +
  • +
  • + + CVE ID Assignment + +
  • +
@@ -99,8 +114,8 @@

Reserve

The ID is reserved, which is the initial state of a CVE Record.

- The Reserved state means that CVE stakeholder(s) are using the CVE ID for early-stage vulnerability coordination and management, - but the CNA is not yet ready to publicly disclose the vulnerability. + The Reserved state means that CVE stakeholder(s) are using the CVE ID for early-stage vulnerability coordination and + management, but the CNA is not yet ready to publicly disclose the vulnerability.

@@ -108,7 +123,7 @@
5

Submit

-

CVE Program participant submits the details.

+

CVE Program partner submits the details.

Details include but are not limited to affected product(s); affected or fixed product versions; vulnerability type, root cause, or impact; and at least one public reference. @@ -143,17 +158,23 @@

- A CVE Record is the descriptive data about a vulnerability associated with a CVE ID, provided by a CVE Numbering - Authority (CNA). This data is provided - in multiple human and machine-readable formats. + A CVE Record is the descriptive data about a vulnerability associated with a CVE ID, provided by a + + CVE Numbering Authority (CNA) + + partner. This data is provided in a human and machine-readable + + format + .

-

Each CVE Record includes the following:

+

Each CVE Record includes, at a minimum, the following:

  1. CVE ID with four or more digits in the sequence number portion of the ID (i.e., “CVE-1999-0067”, “CVE-2019-12345”, “CVE-2021-7654321”).
  2. Brief description of the security vulnerability.
  3. +
  4. Affected products and versions.
  5. Any pertinent references (i.e., vulnerability reports and advisories).

A CVE Record is associated with one of the following states:

@@ -172,15 +193,21 @@ so that users know that the CVE ID and CVE Record are invalid. -

The CVE Program’s CNA Rules include additional helpful information about CVE Records:

+

+ The CVE Program’s + CNA Rules + include additional helpful information about CVE Records: +

  • - CVE Record - Information Requirements – the full requirements for a CVE Record. + + CVE Record Content +
  • - Assignment Rules - – the data elements required within a CVE Record. + + CVE ID Assignment +