Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am writing an application which uses CVE identifiers to cross-reference vulnerabilities. I would like to make it compatible with future CVE identifiers.

If it happens that there are more than 9999 CVE identifiers in a year, what number will follow after 9999?

For example what will be the identifier after CVE-2012-9999? Will it be CVE-2012-10000 or something else?

The highest CVE number in 2011 seems to be CVE-2011-5096 thus it is just a matter of time when this becomes a real issue.

I have tried to find this out at https://cve.mitre.org/ but I can only find the following:

CVE entries and candidates are of the form CVE-YYYY-XXXX where YYYY is a year, and XXXX is a number.

That does not really help.

share|improve this question
add comment

1 Answer 1

up vote 7 down vote accepted

The Common Vulnerability and Exposures system is maintained by Mitre. The Mitre corporation manages the CVE list and serves as an organizer for the CVE community.

At the start of the year Mitre will allocate blocks of CVE numbers to various CVE Numbering authorities out of the full 9998 available (0001-9999). As a result, all CVE numbers issued to an authority within a given year will fall within a range. For example in 2012 all CVE numbers issued to Apple products fall within the CVE-2012-3600 range. Mitre will leave unallocated space in order to issue new CVE numbers if a CVE authority were to exhaust their supply.

So what about your question? What if they have 10,000 CVE numbers issued in one year? Well the most ever issued was 6,608 in 2006. So that was close, but since 2006 there has been an unsettling rate of decline so it doesn't look like we will ever issue 10,000 CVE numbers in one year. If we were, I suspect that we will have CVE-2012-10000. They would do this because its regular, the only reason why they have the four digit number scheme is to allow for pre-allocation to CVE authorities.

From my experience emailing Mitre is usually the best way to obtain CVE numbers. They treat you with respect and have the option to preserve your anonymity. Mitre will work with vendors to make sure the issues are fixed and issue a CVE to the public when a fix is available.

share|improve this answer
1  
+1 for the advice around emailing Mitre. They're curt, professional and accomodating, even in cases where the vendor is being (to put it bluntly) an asshole. –  Polynomial Aug 6 '12 at 6:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.