[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 2 Jun 2017 10:52:08 -0600
From: "kseifried@...hat.com" <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, Qhdwns123 <qhdwns123@...tonmail.com>
Subject: Re: What happens in order to get CVE numbers
When to ask for a CVE Identifier
CVE Identifiers (also called “CVE names,” “CVE numbers,” “CVE-IDs,” and
“CVEs”) are unique, common identifiers for publicly known information
security vulnerabilities.
In other words a CVE is an identifier for something that we know is a
vulnerability (in other words we have to be sure that it is a
vulnerability and not just a hardening issue), and the issue will become
public at some point.
In other words as soon as you know something is a security issue, and
you can be reasonably certain that the issue will be made public (which
may or may not include fixing it) you can get a CVE. In fact it’s much
better to get a CVE as early as possible in the process, then the CVE
can be used in things like commits that fix the issue, it can be applied
to bug entries/issues, and ideally used in Change Logs or release notes
when the fix is released.
As for who exactly asks for the CVE there are a few simple rules:
1) If the software belongs to an entity that is a CNA (CVE Numbering
Authority, e.g. Red Hat, Apache, Microsoft) then you MUST ask the CNA to
assign the CVE first, if this does not work you can go to the CNA’s
parent (e.g. MITRE) and then ask them.
2) If the software belongs to an entity that is NOT a CNA (e.g. most
projects) then for Open Source you can either ask the DWF, or MITRE, and
for closed source you can ask MITRE. Either the researcher or the
project can ask for the CVE, but we do ask that you coordinate so that
multiple requests are not sent in.
TL;DR: Anyone can ask for the CVE, we only ask that the request be
reasonably certain that it is an actual vulnerability and that they
ideally coordinate with the project responsible for the software. We
also suggest that the CVE be requested as early on as possible to make
coordination and identification easier.
DWF: https://iwantacve.org/
MITRE: https://cveform.mitre.org/
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
