0

Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or by whatever else reason.)

NVD description mentions Rejected mark; obviously in this case the CVE ID still remains in the database.

I need to know whether I should handle this case by software which periodically queries NVD.

  • I think normally, when a CVE is fixed, a new Version of the Software implements the Fix (not the same where the CVE is). Like a Version 1.2.3 with a CVE, would Release a fixed version with the number 1.2.4 or 1.2.3-hotfix – Serverfrog Feb 13 at 11:56
  • 1
    @Serverfrog I don't think that's what OP is asking. OP: AFAIK from a purely logical view: no, but every system could potentially be tampered with, maliciously or otherwise. – Tobi Nary Feb 13 at 12:22
  • @TobiNary Yes, I'm asking about what you call "purely logical view". I do not plan to handle compromise or misconfiguration of NVD. – Konstantin Shemyak Feb 13 at 12:25
  • I cannot find an official statement that verifies our guess, thus no answer. But: the numbers are non-consecutive (due to blocks being allotted to different organizations) and those might temporarily submit wrong input that subsequently gets sanatized. This might lead to CVEs disappearing, but usually: no. – Tobi Nary Feb 13 at 12:31
3

No. Numbers would never need to be removed from the database. if they are created and then it appears they were created in error or the vulnerability were a false-positive, they would just be marked 'Rejected' indefinitely - or until proven otherwise. This avoids the possibility of the same vulnerability linking to several CVE numbers for whatever reason.

However, for your purposes... Yes, you should handle the potential for data to be removed from the DB. Regardless of how any site is supposed to function politically, it cannot be guaranteed to function like that technically.

  • Is there a statement anywhere on NVD web site (or anywhere else) confirming this? – Konstantin Shemyak Feb 13 at 18:13
  • (Special upvote for the second paragraph of the answer!) – Konstantin Shemyak Feb 13 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.