Conversation

Notices

1. Embed this notice
   BrianKrebs (briankrebs@infosec.exchange)'s status on Wednesday, 16-Apr-2025 05:51:04 JST BrianKrebs

   I boosted several posts about this already, but since people keep asking if I've seen it....

   MITRE has announced that its funding for the Common Vulnerabilities and Exposures (CVE) program and related programs, including the Common Weakness Enumeration Program, will expire on April 16. The CVE database is critical for anyone doing vulnerability management or security research, and for a whole lot of other uses. There isn't really anyone else left who does this, and it's typically been work that is paid for and supported by the US government, which is a major consumer of this information, btw.

   I reached out to MITRE, and they confirmed it is for real. Here is the contract, which is through the Department of Homeland Security, and has been renewed annually on the 16th or 17th of April.

   https://www.usaspending.gov/award/CONT_AWD_70RCSJ23FR0000015_7001_70RSAT20D00000001_7001

   MITRE's CVE database is likely going offline tomorrow. They have told me that for now, historical CVE records will be available at GitHub, https://github.com/CVEProject

   Yosry Barsoum, vice president and director at MITRE's Center for Securing the Homeland, said:

   “On Wednesday, April 16, 2025, funding for MITRE to develop, operate, and modernize the Common Vulnerabilities and Exposures (CVE®) Program and related programs, such as the Common Weakness Enumeration (CWE™) Program, will expire. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE as a global resource.”

   • iced depresso repeated this.
   • Embed this notice
     feld (feld@friedcheese.us)'s status on Wednesday, 16-Apr-2025 09:00:22 JST feld

     in reply to
     @briankrebs time to just go back to posting on full-disclosure mailing list and having no embargoes, let people figure it out from there :)
   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Wednesday, 16-Apr-2025 09:00:24 JST BrianKrebs

     in reply to

     • James Berthoty

     Pretty cool explainer on why MITRE's CVE is so central to the the process of how a vulnerability disclosure becomes official, and widely recognized. From James Berthoty on LinkedIn @jamesberthoty

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Wednesday, 16-Apr-2025 12:08:08 JST 翠星石

     in reply to
     @briankrebs Too be honest, https://www.cve.org/ was already totally useless, as it doesn't show anything unless your computer carries out arbitrary remote code execution via JavaScript (a severe vulnerability).
   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Wednesday, 16-Apr-2025 13:49:22 JST BrianKrebs

     in reply to

     Finally put together a proper story on this funding debacle for MITRE's CVE program.

     "A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to maintain the Common Vulnerabilities and Exposures (CVE) program -- which is traditionally funded each year by the Department of Homeland Security -- expires on April 16."

     https://krebsonsecurity.com/2025/04/funding-expires-for-key-cyber-vulnerability-database/

   • Embed this notice
     Philip Weiss (Phil in SF) (kingrat@sfba.social)'s status on Wednesday, 16-Apr-2025 13:49:22 JST Philip Weiss (Phil in SF)

     in reply to

     @briankrebs how much is the funding normally?

   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Wednesday, 16-Apr-2025 14:42:29 JST BrianKrebs

     in reply to

     It's worth asking again who would benefit from taking CVE offline? Surely not the United States government, nor its private companies. Not its allies (such as they are now) in Europe. But it almost certainly would help our adversaries, like China and Russia, because confusion and uncertainty works to their advantage always.

     Haelwenn /элвэн/ :triskell: likes this.
     Peter Krefting repeated this.
   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Wednesday, 16-Apr-2025 14:42:29 JST BrianKrebs

     in reply to

     Probably the last CVE indexed before it goes dark should be CVE-2025-DOGE (critical, local privilege escalation vulnerability that leads to malicious code execution and data exfiltration).

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Thursday, 17-Apr-2025 00:22:05 JST BrianKrebs

     in reply to

     UPDATE: The CVE board today announced the creation of non-profit entity called The CVE Foundation that will continue the program's work under a new, unspecified funding mechanism and organizational structure.

     "Since its inception, the CVE Program has operated as a U.S. government-funded initiative, with oversight and management provided under contract," the press release reads. "While this structure has supported the program's growth, it has also raised longstanding concerns among members of the CVE Board about the sustainability and neutrality of a globally relied-upon resource being tied to a single government sponsor."

     The organization's website, thecvefoundation.org, is less than a day old and currently hosts no content. The announcement said the foundation would release more information about its structure and transition planning in the coming days.

   • Embed this notice
     BrianKrebs (briankrebs@infosec.exchange)'s status on Thursday, 17-Apr-2025 00:22:05 JST BrianKrebs

     in reply to

     And, just like that there IS content on the foundation's site.

   • Embed this notice
     Dreugan (_dreugan_@mastodon.social)'s status on Thursday, 17-Apr-2025 00:40:33 JST Dreugan

     • Kevin Beaumont

     @GossiTheDog @briankrebs Nothing wrong with a little redundancy.