[Servercert-wg] Ballot SC39v3: Definition of Critical Vulnerability

[Neil Dunbar]

Colleagues,

I'm continuing the discussion period for SC39 (now at version 3), per 
the text below. As before, I've attached the discussion document to this 
email for background information. The principal change is to lock the 
version of the CVSS in at 2.0, while retaining the "critical" threshold 
at 7.0. This removes the ambiguity as to which CVSS score should apply 
to define a critical vulnerability.

There are other issues surrounding vulnerability patching to be 
addressed, but this ballot was only ever supposed to be an editorial 
change, rather than describe additional practices.

The following motion has been proposed by Neil Dunbar of TrustCor and 
endorsed by Ben Wilson (Mozilla) and Corey Bonnel (DigiCert).

Purpose of Ballot:

It was brought to the attention of the NetSec Subgroup that the URL in 
the NCSSRs which points to the definitions of the CVSS security scoring 
system is no longer the appropriate one; moreover the definition of 
“Critical Vulnerability” is no longer strictly correct by the 
definitions currently posted by NIST.

Definitions of terms should always be consistent, especially when the 
term is canonically defined by an external body; references should be 
updated as and when they change on the canonical source.

-- MOTION BEGINS --

This ballot modifies the “Network and Certificate System Security 
Requirements” based on Version 1.5.

Under the section “Definitions”:

Remove the current definition:

Critical Vulnerability: A system vulnerability that has a CVSS score of 
7.0 or higher according to the NVD or an equivalent to such CVSS rating 
(see http://nvd.nist.gov/home.cfm), or as otherwise designated as a 
Critical Vulnerability by the CA or the CA/Browser Forum.
Insert a new definition:

Critical Vulnerability: A system vulnerability that has a CVSS v2.0 
score of 7.0 or higher according to the NVD or an equivalent to such 
CVSS rating (see https://nvd.nist.gov/vuln-metrics/cvss), or as 
otherwise designated as a Critical Vulnerability by the CA or the 
CA/Browser Forum.

-- MOTION ENDS --

* WARNING *: USE AT YOUR OWN RISK. THE REDLINE BELOW IS NOT THE OFFICIAL 
VERSION OF THE CHANGES (CABF Bylaws, Section 2.4(a)):

A comparison of the changes can be found at:

https://github.com/cabforum/servercert/compare/2b7720f...neildunbar:61fd381?diff=split

This ballot proposes one Final Maintenance Guideline.

The procedure for approval of this ballot is as follows:

Discussion:  (7+ days)
Start Time: 2021-01-19 17:00 UTC
End Time:  not before 2021-01-26 17:00 UTC

Vote for approval    (7 days)
Start Time: TBD
End Time: TBD

Regards,

Neil

-------------- next part --------------
A non-text attachment was scrubbed...
Name: SC39v3 Ballot - Critical Vulnerability Definitions.pdf
Type: application/pdf
Size: 65491 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210119/9750fad2/attachment-0001.pdf>