Mastodawn

RootWyrm 🇺🇦

#infosec people, THIS is big and you need it in front of management RIGHT NOW.

MITRE has informed the CVE board members that effective TONIGHT, funding to run CVE and CWE is effectively gone. The US federal government contracts MITRE to run these programs including both management, operations, and infrastructure.

This not only could but almost certainly will result in disruptions to CVE and CWE including a halt of all operations if new contracts/funding are not secured.

Bluewater_61 Apr 15

@rootwyrm @desperadoduck Thank you, this seems to be an important thing. Would you mind writing the post up again in a way that a normal, educated (MD) , and interested person can understand it?

@Developmentdoc @rootwyrm @desperadoduck

this is my attempt to explain this problem for people who do not work in infosec:

When a security issue with any sort of computer product is found, it’s suppose to be forwarded to these people, MITRE. They assign each one a tracking name, maintain a big database, and publish a list of new ones.

Whether you are a huge corporation or a small business with a website, this list is incredibly helpful in staying on top of what needs to be fixed. Your computer has software components from literally thousands of different organizations running on it. Overlooking that one critically needs an update is how you wake up to your whole hospital having been ransomwared by criminals.

Cutting the funding for this means that there’s no centralized list everyone can reference and trust to be updated in a timely fashion. Hacking incidents, in general, everywhere, will begin to rise.

mx trouble Apr 16

@0xabad1dea @Developmentdoc @rootwyrm @desperadoduck i think that's great, i'd just add: even WHEN someone steps up to run an alternate list (it WILL happen, and fast, if this goes down), if this one goes dark for even a day, it is VERY likely someone takes opportunistic advantage of that chaos. this week's gonna be rough.

Rocketman Apr 16

@0xabad1dea @Developmentdoc @rootwyrm @desperadoduck That's a very good explanation. I'll try to add a bit about what it looks like from the perspective of a company selling software or devices:

You make software, mostly by plugging together existing components - maybe a Linux OS, a database, and other stuff.

Each of those components might have security holes that are discovered over time. So you subscribe to the CVE database, and in case one of your components is affected, you get an alert.

Rocketman Apr 16

@0xabad1dea @Developmentdoc @rootwyrm @desperadoduck Literally everyone in the industry has been relying on this subscription service. And now it looks like that service is going away. So as a vendor, I now have no way of tracking security holes in my product.

It's probably not the end of the world. People will find a way. But it absolutely is a major disruption for everyone not just in IT security, but for software producers and device manufacturers worldwide.

@slothrop @0xabad1dea @Developmentdoc @rootwyrm @desperadoduck Sounds like a good market opportunity. If the service is so critical, people will pay for it, so someone will probably step up to run such a thing as a subscription service.

abadidea Apr 16

@rumpel I cannot possibly trust a person who hears “public utility for the common good of everyone’s safety” and says the words “market opportunity”.

@0xabad1dea oh I'm sure this will end great! I nominate Elsevier to run this service :)

Rocketman Apr 16

@0xabad1dea @rumpel Seconding this. Privatizing this service would be an amazingly bad idea.

First, it would screw with the perception of transparency. Can you really trust a commercial provider to report vulnerabilities honestly? Maybe they have some sort of deal with one or more of the big software producers.

Second, there's seldom a direct relationship between those who discover vulnerabilities, those who process them, and those who fix them. Super hard to monetize without screwing stuff up

neofox_flag_trans

@slothrop @0xabad1dea @rumpel thirding this for a different reason.

Even with CNAs being distributed (and who would do volunteer work to help a for-profit corporation) we already had a shortage of people with actual knowledge of the projects and ended up with vulnerabilities that didn't make sense. There's no way to run this database on such a broad spectrum of things like "all of software" and not go bankrupt because of the amount of specialized knowledge that needs hiring

In GDB, which for those that don't know, is meant to be used locally to find and fix issues in things you made yourself, we already got several "if I do this GDB crashes, that's a denial of service" or "it leaks 10B of memory one time when I run this command, memory exhaustion!!!". Can you imagine if there was financial incentive to accept and report these things?

@0xabad1dea @Developmentdoc @rootwyrm @desperadoduck I would like to specifically note that this is *the de facto vulnerability database* for *the whole world*, not just the US.

Alexander The 1st Apr 16

@dramforever @0xabad1dea @Developmentdoc @rootwyrm @desperadoduck Right - another way that I would think of it is that it's sort of a "Recall" department like when the FDA recalls lettuce for having e.Coli, or tells people when they can't use baby formula from a particular plant because it has bacteria in it.

Only on an U.N./W.H.O. level scale, with Day-1 delivery of foods that don't need to be recalled. Only for software bugs.

@0xabad1dea Have you seen this? https://www.thecvefoundation.org/home Seems like a potentially good sign, but the lack of any names is a bit worrying.

CVE Foundation

FOR IMMEDIATE RELEASE April 16, 2025 CVE Foundation Launched to Secure the Future of the CVE Program [Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures (CVE) Program, a

abadidea Apr 16

@Kufat I am skeptical that this is a legitimate website and not someone hurriedly trying to figure out how to set up a good phish especially since... it's already run by a non-profit organization. Why would they need a new one?

@0xabad1dea Hmm. I don't find the idea of needing a new nonprofit to be that suspicious by itself, because it can sometimes be easier to start a new org + move assets/programs over than it would be to modify an existing org's charter, etc.
My concern was the lack of names on the page + lack of links to it from reliable sources. Ars and others have now linked it, though, so I guess it's probably legit?

Bluewater_61 Apr 16

@0xabad1dea @rootwyrm @desperadoduck Thank you! Now I understand, and this is of course really important. Appreciate you taking the time to explain!