Introduction Organization of CSAF CVRF The specification is split into seven chapters. Terminology The key NOT”, NOT”, NOT”, “MUST”, “MUST “REQUIRED”, “SHALL”, “SHALL “SHOULD”, “SHOULD and in this document are to be interpreted as described in []. “RECOMMENDED”, “MAY”, “OPTIONAL” Terms and Definitions For the purposes of this document, the following applies: Advisory as in ISO/IEC [] — Coordinator as in ISO/IEC 29147 [] — Finder as in ISO/IEC 29147 [] — Online Services as in ISO/IEC 29147 [] — Product as in ISO/IEC 29147 [] — Remediation as in ISO/IEC 29147 [] — Service as in ISO/IEC 29147 [] — Vendor as in ISO/IEC 29147 [] — Vulnerability as in ISO/IEC 29147 [] — Date Time Value as defined in section 2.2.1 — Positive Integer integer number > 0 (xs:positiveInteger) cf. [] — Cardinality minimal and maximal occurrence noted as mathematical closed — interval with the special symbol (∞) for infinity to indicate no upper limit. Enumeration Set a finite set of domain values (case-sensitive string literals) — implemented via enumerations on cf. [] Abbreviated Terms CCE Common Configuration Enumeration — CSAF Common Security Advisory Framework — CPE Common Platform Enumeration [] — CSIRT Computer Security Incident Response Team — CVE Common Vulnerabilities and Exposures [] — CVRF Common Vulnerability Reporting Framework — CVSS Common Vulnerability Scoring System [] — CWE Common Weakness Enumeration [] — Internet Consortium for Advancement of Security on the Internet, — ID Identifier — OASIS Organization for the Advancement of Structured Information Standards, — PSIRT Product Security Incident Response Team —
Introduction Organization of CSAF CVRF The specification is split into seven chapters. Terminology The key “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in []. Terms and Definitions For the purposes of this document, the following applies: Advisory — as in ISO/IEC [] Coordinator — as in ISO/IEC 29147 [] Finder — as in ISO/IEC 29147 [] Online Services — as in ISO/IEC 29147 [] Product — as in ISO/IEC 29147 [] Remediation — as in ISO/IEC 29147 [] Service — as in ISO/IEC 29147 [] Vendor — as in ISO/IEC 29147 [] Vulnerability — as in ISO/IEC 29147 [] Date Time Value — as defined in section 2.2.1 Positive Integer — integer number > 0 (xs:positiveInteger) cf. [] Cardinality — minimal and maximal occurrence noted as mathematical closed interval with the special symbol (∞) for infinity to indicate no upper limit. Enumeration Set — a finite set of domain values (case-sensitive string literals) implemented via enumerations on cf. [] Abbreviated Terms CCE — Common Configuration Enumeration CSAF — Common Security Advisory Framework CPE — Common Platform Enumeration [] CSIRT — Computer Security Incident Response Team CVE — Common Vulnerabilities and Exposures [] CVRF — Common Vulnerability Reporting Framework CVSS — Common Vulnerability Scoring System [] CWE — Common Weakness Enumeration [] — Internet Consortium for Advancement of Security on the Internet, ID — Identifier OASIS — Organization for the Advancement of Structured Information Standards, PSIRT — Product Security Incident Response Team
csaf-cvrf-v1.2-wd01-2017-04-03-eric.docx