Name of Your Organization:

Red Hat, Inc

Web Site:

http://www.redhat.com/

Compatible Capability:

Red Hat Security Advisories

Capability home page:

http://rhn.redhat.com/errata/

1) Product Accessibility <CR_2.4>

Provide a short description of how and where your capability is made available to your customers and the public (required):

Red Hat are providing CVE names on all Red Hat Security Advisories where appropriate and working with MITRE to analyze existing and add new Linux related issues.

Red Hat Security Advisories are distributed by Red Hat to various public security mailing lists, are available from our website, and are made available to users of the Red Hat Network.

4) Map Currency Indication <CR_5.1>

Describe how and where your capability indicates the most recent CVE version used to create or update its mappings (required):

This is implicit as our advisories when released contain the latest CVE names.

5) Map Currency Update Approach <CR_5.2>

Indicate how often you plan on updating the mappings to reflect new CVE versions and describe your approach to keeping reasonably current with CVE versions when mapping them to your repository (recommended):

Our process includes a monthly check to keep the CVE mapping accurate and current. We have automated scripts that check for the change in status of candidates to entries and a process in place to propagating those changes.

6) Map Currency Update Time <CR_5.3>

Describe how and where you explain to your customers the timeframe they should expect an update of your capability's mappings to reflect a newly released CVE version (recommended):

Not applicable

7) CVE and Compatibility Documentation<CR_4.1>

Provide a copy, or directions to its location, of where your documentation describes CVE and CVE compatibility for your customers (required):

http://www.redhat.com/solutions/security/news/cve.html

8) Documentation of Finding Elements Using CVE Names <CR_4.2>

Provide a copy, or directions to its location, of where your documentation describes the specific details of how your customers can use CVE names to find the individual security elements within your capability's repository (required):

http://www.redhat.com/solutions/security/news/cve.html

9) Documentation of Finding CVE Names Using Elements <CR_4.3>

Provide a copy, or directions to its location, of where your documentation describes the process a user would follow to find the CVE names associated with individual security elements within your capability's repository (required):

http://www.redhat.com/solutions/security/news/cve.html

11) Candidates Versus Entries Indication <CR_6.1>

If CVE candidates are supported or used, explain how you indicate that candidates are not accepted CVE entries (required):

http://www.redhat.com/solutions/security/news/cve.html

12) Candidates Versus Entries Explanation <CR_6.2>

If CVE candidates are supported or used, explain where and how the difference between candidates and entries is explained to your customers (recommended):

http://www.redhat.com/solutions/security/news/cve.html

13) Candidate to Entry Promotion <CR_6.3>

If CVE candidates are supported or used, explain your policy for changing candidates into entries within your capability and describe where and how this is communicated to your customers (recommended):

http://www.redhat.com/solutions/security/news/cve.html

14) Candidate and Entry Search Support <CR_6.4>

If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's ability to look for candidates and entries by using just the YYYY-NNNN portion of the CVE names (recommended):

http://www.redhat.com/solutions/security/news/cve.html

15) Search Support for Promoted Candidates <CR_6.5>

If CVE candidates are supported or used, explain where and how a customer can find the explanation of your search function's support for retrieving the CVE entry for a candidate that is no longer a candidate (recommended):

http://www.redhat.com/solutions/security/news/cve.html

16) Candidate Mapping Currency Indication <CR_6.6>

If CVE candidates are supported or used, explain where and how you tell your users how up-to-date your candidate information is (recommended):

http://www.redhat.com/solutions/security/news/cve.html

Type-Specific Capability Questions

26) Finding Online Capability Tasks Using CVE Names <CR_A.4.1>

Give detailed examples and explanations of how a "find" or "search" function is available to the user to locate tasks in the online capability by looking for their associated CVE name or through an online mapping that links each element of the capability with its associated CVE name(s) (required):

Find CAN-2001-0784

https://rhn.redhat.com/cve/CAN-2001-0784.html

Find all 2001 Candidates

http://www.redhat.com/cgi-bin/search.cgi?q=CAN-2001&form=extended&wm=beg

27) Online Capability Interface Template Usage <CR_A.4.1.1>

Provide a detailed description of how someone can use your "URL template" to interface to your capability's search function (recommended):

Examples:

http://www.example.com/cgi-bin/db-search.cgi?cvename=CVE-YYYY-NNNN
http://www.example.com/cve/CVE-YYYY-NNNN.html

https://rhn.redhat.com/cve/CVE-YYYY-NNNN.html

28) Online Capability CGI Get Method Support <CR_A.4.1.2>

If the URL template is for a CGI program, does it support the HTTP "GET" method? (recommended):

YES

29) Finding CVE Names Using Online Capability Elements <CR_A.4.2>

Give detailed examples and explanations of how, for reports that identify individual security elements, the online capability allows the user to determine the associated CVE names for the individual security elements in the report (required):

Each applicable security advisory lists CVE names as part of the initial data and, automatically, in the references section. For example:

http://rhn.redhat.com/errata/RHSA-2002-155.html

Where a security advisory lists individual security elements each is tagged individually with the CVE name as well as appearing in the initial summary and as direct links in the reference section.

31) Electronic Document Format Info <CR_B.3.1>

Provide details about the different electronic document formats that you provide and describe how they can be searched for specific CVE-related text (required):

All documents can be searched from the Red Hat main search engine on the www.redhat.com web site.

33) Electronic Document Element to CVE Name Mapping <CR_B.3.3>

Provide example documents that demonstrate the mapping from the capability's individual elements to the respective CVE name(s) (recommended):

http://rhn.redhat.com/errata/RHSA-2001-165.html

34) Finding Elements Using CVE Names Through the GUI <CR_B.4.1>

Give detailed examples and explanations of how the GUI provides a "find" or "search" function for the user to identify your capability's elements by looking for their associated CVE name(s) (required):

Find CAN-2001-0784

https://rhn.redhat.com/cve/CAN-2001-0784.html

Find all 2001 Candidates

http://www.redhat.com/cgi-bin/search.cgi?q=CAN-2001&form=extended&wm=beg

35) GUI Element to CVE Name Mapping <CR_B.4.2>

Briefly describe how the associated CVE names are listed for the individual security elements or discuss how the user can use the mapping between CVE entries and the capability's elements, also describe the format of the mapping (required):

CVE Names are listed in the meta data and references of advisories.

37) Statement of Compatibility <CR_2.7>

Have an authorized individual sign and date the following Compatibility Statement (required):

"As an authorized representative of my organization I agree that we will abide by all of the mandatory CVE Compatibility Requirements as well as all of the additional mandatory CVE Compatibility Requirements that are appropriate for our specific type of capability."

Name: Mark J Cox

Title: Security Response Team Lead

38) Statement of Accuracy <CR_3.4>

Have an authorized individual sign and date the following accuracy Statement (recommended):

"As an authorized representative of my organization and to the best of my knowledge, there are no errors in the mapping between our capability's Repository and the CVE entries our capability identifies."

Name: Mark J Cox

Title: Security Response Team Lead