csaf — archive

adding a new value for "category" in "remediation"

From: Feng Cao
To: [email protected]
Date: Tue, 14 Jun 2022 21:46:00 -0000

Dear TC members, I'd like to discuss about adding a new value for "category" in "remediation". Problem: The third party CVEs will be announced in advisories. Some of them are re-scored with CVSSv3.1 = 0.0. "known_not_affected" is used in "product_status". In "remediation", "category" doesn't have a matching value for "known_not_affected" (the question on why to announce them with CVSSv3.1=0.0 is to provide the info to the customers, as their scanners might catch the third party components, and then they will ask the support). Solution: Add a new value, such as "patch_for_not_affected". Thanks, Feng Cao, PHD, CISSP, PMP Oracle Security Alerts