RFD: Redefining a Reference

[jayjacobs]

This RFD proposes improvements to the references section to enhance various downstream tasks.

• 71% of URLs (92,736 / 130,906) did not include a name value.
• 70% of CVEs (34,857 / 49,722) did not include name values for any references.
• 50% of URLs (65,475 / 130,906) did not include a tag value
• 48% of CVEs (23,914 / 49,722) did not include tag values for any references.
• 55% of tags used (786,038 / 1,428,322) used x_* custom tags, indicating high variance and weak standardization.

This RFD is truly a "request for discussion" and is intended to raise questions for the QWG to discuss about the value of references and supporting metadata. It puts forth several fields that would improve tasks such as quality auditing, automatic retrieval and parsing of references. Clean metadata around references would also reduce the need for people to click through every link to determine their value.

Direct link to RFD Markdown: https://github.com/jayjacobs/cve-schema/blob/29addc446e9f9d85bbadee72f20257d13358d930/rfds/RFD_Redifining_a_Reference.md

[alilleybrinker]

Still going through the RFD in detail, but I want to voice my support for the intent and direction here. Completely unlabeled URLs are the enemy of automation, requiring people to rely either on inconsistent heuristic rules or full human review in order to use them.

To me, the positive impacts include:

• For vulnerability managers: can more easily use the URLs to identify patches, release notes, vulnerability analyses, and other kinds of relevant materials associated with a CVE Record.
• For vulnerability and general security researchers: can more easily identify the right types of links to do their research at scale.

Just as a small example: years ago I built a tool I called blamethrower that would identify commits that introduced a vulnerability. It worked by inferring patch commits from CVE Record references, then recursively Git-blaming to identify the originating source of the code being patched in that commit. The hardest part of building it was building good-enough inference to identify patch commits!