← Prev in month ← Prev in thread
Next in thread → Next in month →

adding a new value for "category" in "remediation"

From
Feng Cao
Date
2022-06-14T21:46:00+00:00
ID
Thread
adding a new value for "category" in "remediation"
Dear TC members,  I'd like to discuss about adding a new value for "category" in "remediation".  Problem:  The third party CVEs will be announced in advisories. Some of them are re-scored with CVSSv3.1 = 0.0. "known_not_affected" is used in "product_status". In "remediation", "category" doesn't have a matching value for "known_not_affected"  (the question on why to announce them with CVSSv3.1=0.0 is to provide the info to the customers, as their scanners might catch the third party components, and then they will ask the support).  Solution:  Add a new value, such as "patch_for_not_affected".  Thanks,  Feng Cao, PHD, CISSP, PMP Oracle Security Alerts
← Prev in month ← Prev in thread
Next in thread → Next in month →