mastodon - Link to source

#infosec people, THIS is big and you need it in front of management RIGHT NOW.

MITRE has informed the CVE board members that effective TONIGHT, funding to run CVE and CWE is effectively gone. The US federal government contracts MITRE to run these programs including both management, operations, and infrastructure.

This not only could but almost certainly will result in disruptions to CVE and CWE including a halt of all operations if new contracts/funding are not secured.

MITRE ‘ SOLVING PROBLEMS FOR A SAFER WORLD" April 15, 2025 Dear CVE Board Member, We want to make you aware of an important potential issue with MITRE’s enduring support to CVE. On Wednesday, April 16, 2025, the current contracting pathway for MITRE to develop, operate, and modernize CVE and several other related programs, such as CWE, will expire. The government continues to make considerable efforts to continue MITRE's role in support of the program If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of citical infrastructure. MITRE continues to be committed to CVE as a global resource. We thank you as a member of the CVE Board for your continued partnership. Sincerely, Yosry Barsoum VP and Director Center for Securing the Homeland (CSH)
#infosec
in reply to RootWyrm 🇺🇦

mastodon - Link to source

RootWyrm 🇺🇦

And not only is this from reliable sources, I can verify it checks out.
h/t bsky.app/profile/tib3rius.bsky… 👍

One, the name and position is correct.
Two, that is MITRE corporate communications compliant. They have rules about it.
Three, I know that the CVE/CWE contract runs April 15 to April 15 and no new contract has been published.

FFRDC (Oct 2024-Oct 2029) is a separate contract issued by NIST. CVE+CWE is a DHS/CISA contract.

This entry was edited (5 months ago)
in reply to RootWyrm 🇺🇦

mastodon - Link to source

RootWyrm 🇺🇦

"OMG SKY IS FALLING!$@&*$@!"

Hi. Policy hat on!

Yes and no, no and yes. This is why I specifically said: TELL MANAGEMENT. This means that the reliability of CVE+CWE will be negatively impacted.

If you do not update your POLICIES to treat CVE+CWE as no longer responsive and reliable, and start making changes to address that, you will be in for a world of hurt.

⇧