Ballot SC39v3: Definition of Critical Vulnerability

The voting period for Ballot SC39v3 has concluded and the Ballot has Passed.

Voting Results

Certificate Issuers

22 votes total, with no abstentions

• 23 Yes votes: Buypass, Camerfirma, Certum, Chunghwa Telecom, D-Trust, DigiCert, Disig, eMudgra, Entrust, Firmaprofesional, GlobalSign, GoDaddy, HARICA, Izenpe, Let’s Encrypt, NAVER, Sectigo, SecureTrust, SwissSign, TWCA, Telia Company, TrustCor, Visa
• 0 No Votes
• 0 Abstentions

Certificate Consumers

5 votes total, with no abstentions

1. 5 Yes votes: Apple, Cisco, Google, Microsoft, Mozilla
2. 0 No votes
3. 0 Abstentions

Bylaw Requirements

1. Bylaw 2.3(f) requires:
   • A “yes” vote by two-thirds of Certificate Issuer votes and by 50%-plus-one of Certificate Consumer votes. Votes to abstain are not counted for this purpose. This requirement was met for both Certificate Issuers and Certificate Consumers.
   • at least one Certificate Issuer and one Certificate Consumer Member must vote in favor of a ballot for the ballot to be adopted. This requirement was also met.
2. Bylaw 2.3(g) requires that a ballot result only be considered valid when “more than half of the number of currently active Members has participated”. Votes to abstain are counted in determining quorum. Half of the currently active members at the start of voting was 12, so the quorum was 13 for this ballot. This requirement was met.

Motion begins

This ballot modifies the “Network and Certificate System Security Requirements” based on Version 1.5.

Under the section “Definitions”:

Remove the current definition:

Critical Vulnerability: A system vulnerability that has a CVSS score of 7.0 or higher according to the NVD or an equivalent to such CVSS rating (see http://nvd.nist.gov/home.cfm), or as otherwise designated as a Critical Vulnerability by the CA or the CA/Browser Forum. Insert a new definition:

Critical Vulnerability: A system vulnerability that has a CVSS v2.0 score of 7.0 or higher according to the NVD or an equivalent to such CVSS rating (see https://nvd.nist.gov/vuln-metrics/cvss), or as otherwise designated as a Critical Vulnerability by the CA or the CA/Browser Forum.

Motion ends

* WARNING *: USE AT YOUR OWN RISK. THE REDLINE BELOW IS NOT THE OFFICIAL VERSION OF THE CHANGES (CABF Bylaws, Section 2.4(a)):

A comparison of the changes can be found at:

https://github.com/cabforum/servercert/compare/2b7720f…neildunbar:61fd381?diff=split

This ballot proposes one Final Maintenance Guideline.

The procedure for approval of this ballot is as follows:

Vote for approval (7 days) Start Time: 2020-02-02 1700 UTC End Time: 2020-02-09 1700 UTC