NIST, Red Hat unveil commenting system

System will allow vendors to report vulnerabilities, but problems could arise by allowing it to be publicly accessible, one analyst said.

Red Hat and the National Institute of Standards and Technology have agreed to create a commenting system for NIST’s National Vulnerabilities Database (NVD).

The system will give vendors a public forum to contribute information about vulnerabilities that could affect unforeseen targets.

Red Hat originally proposed the idea of using the database to NIST.

“We’ve been brainstorming this for a couple of years trying to figure out how to do it,” said Mark Cox, director of the security response team at Red Hat. Cox is one of the founders of the commenting system.

Red Hat has been using the system in a test program for the past few weeks and has submitted more than a hundred comments. One other company, Linux developer Mandriva, has added a comment about its software.

First of its kind
Cox said no other commenting system like NVD’s exists. The new system will enable users to manage vulnerabilities more efficiently, he said.

Without such a system, users sometimes must call companies directly to check whether certain vulnerabilities affect multiple programs.

“If it’s an Apache vulnerability, then how does that affect Red Hat?”Cox asked. Peter Mell, NVD program manager, said one of NIST’s primary concerns was to give vendors and security companies a chance to comment.

There was “no way for the security industry to put their 2 cents in with respect to what these vulnerabilities mean,” Mell said.

Buyer confusion
Some analysts say the new system could be beneficial for vendors in the long run but added that the fact that the system is publicly accessible could create some problems.

John Pescatore, vice president of Internet security at Gartner, said vendors could cause confusion if they use different terminology.

He said he is also concerned that people posing as vendors could put false information into the system.

“There’s a lot of slips between the cup and the lip,” he said.

Pescatore said NIST plans to create a mechanism to ensure that only authorized vendor representatives have access to the commenting system.


  • Congress
    U.S. Capitol (Photo by M DOGAN / Shutterstock)

    Funding bill clears Congress, heads for president's desk

    The $1.3 trillion spending package passed the House of Representatives on March 22 and the Senate in the early hours of March 23. President Trump is expected to sign the bill, securing government funding for the remainder of fiscal year 2018.

  • 2018 Fed 100

    The 2018 Federal 100

    This year's Fed 100 winners show just how much committed and talented individuals can accomplish in federal IT. Read their profiles to learn more!

  • Census
    How tech can save money for 2020 census

    Trump campaign taps census question as a fund-raising tool

    A fundraising email for the Trump-Pence reelection campaign is trying to get supporters behind a controversial change to the census -- asking respondents whether or not they are U.S. citizens.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.