CVE List - Iberia

POLICY DISCLOSURE

POLICY

Thales’ mission is to safeguard and enhance the business transformation of organizations by managing cybersecurity risk to protect their people and assets.

Thales is fully committed to achieving this mission through ethical and timely disclosure of vulnerability information.

Thanks to the research work of Thales’ research technicians, multiple vulnerabilities have been reported and published, leading Thales to become a CNA under the scope of a CNA-Root, with the consequent authorization to assign CVE identifiers to vulnerabilities detected by its research teams.

DISCLOSURE

With the discovery of the vulnerabilities and the report to Thales, the responsible parties will try to contact the affected vendor. The following aspects should be taken into account:

• Initially, the contact will be made by e-mail against the affected supplier or through any secondary mechanism proposed by the supplier as long as it is secure.
• Thales will arrange with the affected supplier a timeframe according to their situation.
• Although there are such measures and publication times, Thales is complementarily committed to improving the cybersecurity of people and organizations, so to strengthen and improve relationships, it is committed whenever appropriate and acceptable, to provide suppliers with a draft of the notice prior to publication and to participate in a joint and coordinated manner throughout the process.

VULNERABILITY NOTIFICATION

Researchers shall comply with and review the following terms and conditions set forth below that affect products, equipment, applications or services being tested and include at a minimum the following information via secure email to the following address: cve.coordination.iberia@thalesgroup.com

• Code and serial number of the device or software believed to be affected.
• Version of the device or software being analyzed along with the full name or model.
• Description of the behavior observed and the expected behavior that explains the vulnerability.
• Detailed description of the process performed to reproduce the possible problem detected. In case the difficulty is high, it is suggested to send a video showing in detail the steps performed.
• Impact or result of the problem, CVSS, CWE and authors.

After this first contact, Thales will provide the sender of the vulnerability with a tracking number for the treatment and follow-up of the process.

To contact the Thales team, please contact cve.coordination.iberia@thalesgroup.com in encrypted form.

Public PGP key for secure information exchange.

VULNERABILITY IDENTIFICATION

Thales reserves the right to analyze the report sent by the researcher to assess and split or simplify the problems detected on the product or software also determining whether or not they are vulnerabilities.

If they are vulnerabilities, Thales will proceed to register the ID assignments (CVE ID) always in conjunction and coordination with the affected vendor, but having Thales, the last word on the problem or vulnerability.

PUBLISHING

Thales will make every effort to ensure that the vulnerability’s associated vulnerability identifier (CVE ID) is assigned and published.

Thales will reserve the CVE ID after the vendor confirms the issues. The CVE assignment will be shared with the vendor as soon as possible. Once the advisories have been made public, MITRE and, where appropriate, the national computer emergency response teams will be informed.