[Servercert-wg] VOTING BEGINS: Ballot SC39v3:

[Tim Callan]

Sectigo votes YES on SC39v3.

 

From: Servercert-wg <servercert-wg-bounces at cabforum.org> On Behalf Of Neil
Dunbar via Servercert-wg
Sent: Tuesday, February 2, 2021 9:16 AM
To: CA/B Forum Server Certificate WG Public Discussion List
<servercert-wg at cabforum.org>
Subject: [Servercert-wg] VOTING BEGINS: Ballot SC39v3:

 

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know the
content is safe.

 

Colleagues, 

This begins the voting period for ballot SC39v3: Definition of Critical
Vulnerability.

The following motion has been proposed by Neil Dunbar of TrustCor and
endorsed by Ben Wilson (Mozilla) and Corey Bonnell (DigiCert). 

-- MOTION BEGINS -- 

This ballot modifies the "Network and Certificate System Security
Requirements" based on Version 1.5. 

Under the section "Definitions": 

Remove the current definition: 

Critical Vulnerability: A system vulnerability that has a CVSS score of 7.0
or higher according to the NVD or an equivalent to such CVSS rating (see
http://nvd.nist.gov/home.cfm
<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fnvd.nist.g
ov%2Fhome.cfm&data=04%7C01%7Ctim.callan%40sectigo.com%7Cb7c1ec1ac2f34fcabf8c
08d8c7850c6f%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637478721548189180
%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw
iLCJXVCI6Mn0%3D%7C1000&sdata=J1sTlph4FGZOjIaPX4aT43dpBS1C7Z1QGqTpgfuwZc4%3D&
reserved=0> ), or as otherwise designated as a Critical Vulnerability by the
CA or the CA/Browser Forum.


Insert a new definition: 

Critical Vulnerability: A system vulnerability that has a CVSS v2.0 score of
7.0 or higher according to the NVD or an equivalent to such CVSS rating (see
https://nvd.nist.gov/vuln-metrics/cvss
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.
gov%2Fvuln-metrics%2Fcvss&data=04%7C01%7Ctim.callan%40sectigo.com%7Cb7c1ec1a
c2f34fcabf8c08d8c7850c6f%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637478
721548189180%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJ
BTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Di%2F45pBfmxDaUmWpBHw5v%2Fi%2BTGyMa
BJGKffqR4ZFMrE%3D&reserved=0> ), or as otherwise designated as a Critical
Vulnerability by the CA or the CA/Browser Forum. 

-- MOTION ENDS -- 

* WARNING *: USE AT YOUR OWN RISK. THE REDLINE BELOW IS NOT THE OFFICIAL
VERSION OF THE CHANGES (CABF Bylaws, Section 2.4(a)): 

A comparison of the changes can be found at: 

https://github.com/cabforum/servercert/compare/2b7720f...neildunbar:61fd381?
diff=split
<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co
m%2Fcabforum%2Fservercert%2Fcompare%2F2b7720f...neildunbar%3A61fd381%3Fdiff%
3Dsplit&data=04%7C01%7Ctim.callan%40sectigo.com%7Cb7c1ec1ac2f34fcabf8c08d8c7
850c6f%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637478721548199143%7CUnk
nown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXV
CI6Mn0%3D%7C1000&sdata=YgVaC4CaR%2By3wEW7LYO9Htj1a6a707zuhLqP1s22LEw%3D&rese
rved=0>  

This ballot proposes one Final Maintenance Guideline. 

The procedure for approval of this ballot is as follows: 

Vote for approval    (7 days)


Start Time: 2020-02-02 1700 UTC 
End Time: 2020-02-09 1700 UTC

Regards, 

Neil 

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210208/91d2124b/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6792 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210208/91d2124b/attachment.p7s>