attachment
<div dir="ltr"><div>Hi,</div><div><br></div><div>Per Smith's excellent question about how to find information about <br></div><div>Bluetooth and other network protocol and operating system new <br></div><div>vulnerabilities, during our IDS session yesterday at the Joint PWG/OP <br></div><div>Summit Virtual F2F May 2021:</div><div><br></div><div><a href="https://us-cert.cisa.gov/ncas/bulletins">https://us-cert.cisa.gov/ncas/bulletins</a></div><div><br></div><div>Note that CVEs (Common Vulnerabilities and Exposures) each have a <br></div><div>CVSS (Common Vulnerability Scoring System) rating (scroll down below</div><div>to see the v2.0 and v3.0 ranges):<br></div><div><br></div><div><a href="https://nvd.nist.gov/vuln-metrics/cvss">https://nvd.nist.gov/vuln-metrics/cvss</a></div><div><br></div><div>The CISA weekly bulletins still use the CVSS v2.0 scheme, while the NVD</div><div>(National Vulnerability Database) and most vendor reports use the newer</div><div>CVSS v3.0 scheme (more rigorous):</div><div><a href="goog_476697645"><br></a></div><div><a href="https://nvd.nist.gov/">https://nvd.nist.gov/</a></div><div><br></div><div>It's worthwhile scanning the weekly CISA bulletins, but they do typically</div><div>list several hundred new vulnerabilities every week! So scanning takes</div><div>an hour or more.</div><div><br></div><div>At the SAE Vehicle Electrical System Security (TEVEES18) bi-weekly</div><div>calls, the first 15-20 minutes are highlights from the two most recent</div><div>CISA bulletins (ones that clearly impact recent automobiles). That's</div><div>the most lively and valued part of the news items in that meeting.<br></div><div><br></div><div>Cheers,</div><div>- Ira</div><div><br></div><div><br></div><div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><i><font size="1">Ira McDonald (Musician / Software Architect)</font></i></div><div><i><font size="1">Chair - SAE Trust Anchors and Authentication TF<br></font></i></div><div dir="ltr"><i><font size="1">Co-Chair - TCG Trusted Mobility Solutions WG</font></i></div><div><i><font size="1">Co-Chair - TCG Metadata Access Protocol SG<br></font></i></div><div dir="ltr"><i><font size="1">Chair - Linux Foundation Open Printing WG<br>Secretary - IEEE-ISTO Printer Working Group<br>Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG<br>IETF Designated Expert - IPP & Printer MIB<br>Blue Roof Music / High North Inc<br><a style="color:rgb(51,51,255)" href="http://sites.google.com/site/blueroofmusic" target="_blank">http://sites.google.com/site/blueroofmusic</a><br><a style="color:rgb(102,0,204)" href="http://sites.google.com/site/highnorthinc" target="_blank">http://sites.google.com/site/highnorthinc</a><br>mailto: <a href="mailto:blueroofmusic@gmail.com" target="_blank">blueroofmusic@gmail.com</a><br>(permanent) PO Box 221 Grand Marais, MI 49839 906-494-2434</font></i></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>