[Servercert-wg] VOTING BEGINS: Ballot SC39v3: Definition of Critical Vulnerability

[Bruce Morton]

Entrust votes Yes to ballot SC39.

Bruce.

From: Servercert-wg <servercert-wg-bounces at cabforum.org> On Behalf Of Neil Dunbar via Servercert-wg
Sent: Tuesday, February 2, 2021 9:29 AM
To: servercert-wg at cabforum.org
Subject: Re: [Servercert-wg] VOTING BEGINS: Ballot SC39v3: Definition of Critical Vulnerability


Resend: adding the ballot title to the mail thread.
On 02/02/2021 14:15, Neil Dunbar via Servercert-wg wrote:
Colleagues,

This begins the voting period for ballot SC39v3: Definition of Critical Vulnerability.

The following motion has been proposed by Neil Dunbar of TrustCor and endorsed by Ben Wilson (Mozilla) and Corey Bonnell (DigiCert).

-- MOTION BEGINS --

This ballot modifies the “Network and Certificate System Security Requirements” based on Version 1.5.

Under the section “Definitions”:

Remove the current definition:

Critical Vulnerability: A system vulnerability that has a CVSS score of 7.0 or higher according to the NVD or an equivalent to such CVSS rating (see http://nvd.nist.gov/home.cfm<https://urldefense.com/v3/__http:/nvd.nist.gov/home.cfm__;!!FJ-Y8qCqXTj2!O-WfKf2n6L0z5KCTGJUlEEGCaOpOIHkLlxJ8GI7Cij86SVwjf4dUPBHDRfkor1co4t8$>), or as otherwise designated as a Critical Vulnerability by the CA or the CA/Browser Forum.

Insert a new definition:

Critical Vulnerability: A system vulnerability that has a CVSS v2.0 score of 7.0 or higher according to the NVD or an equivalent to such CVSS rating (see https://nvd.nist.gov/vuln-metrics/cvss<https://urldefense.com/v3/__https:/nvd.nist.gov/vuln-metrics/cvss__;!!FJ-Y8qCqXTj2!O-WfKf2n6L0z5KCTGJUlEEGCaOpOIHkLlxJ8GI7Cij86SVwjf4dUPBHDRfkos7XWOlY$>), or as otherwise designated as a Critical Vulnerability by the CA or the CA/Browser Forum.

-- MOTION ENDS --

* WARNING *: USE AT YOUR OWN RISK. THE REDLINE BELOW IS NOT THE OFFICIAL VERSION OF THE CHANGES (CABF Bylaws, Section 2.4(a)):

A comparison of the changes can be found at:

https://github.com/cabforum/servercert/compare/2b7720f...neildunbar:61fd381?diff=split<https://urldefense.com/v3/__https:/github.com/cabforum/servercert/compare/2b7720f...neildunbar:61fd381?diff=split__;!!FJ-Y8qCqXTj2!O-WfKf2n6L0z5KCTGJUlEEGCaOpOIHkLlxJ8GI7Cij86SVwjf4dUPBHDRfkoLVEA4II$>

This ballot proposes one Final Maintenance Guideline.

The procedure for approval of this ballot is as follows:

Vote for approval    (7 days)

Start Time: 2020-02-02 1700 UTC
End Time: 2020-02-09 1700 UTC

Regards,

Neil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210204/a1512492/attachment.html>