[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <2025110538-probation-thickness-0517@gregkh>
Date: Wed, 5 Nov 2025 08:23:09 +0900
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Becoming a CVE Naming Authority for your project
On Tue, Nov 04, 2025 at 08:47:35AM -0300, Rodrigo Freire wrote:
> Open Source Project Maintainers,
>
> Managing security vulnerabilities is currently a significant pain,
> especially with the recent increase in dubious CVE reports due to AI
> assistants. The discussion around questionable CVEs reported against
> projects like dnsmasq, curl highlights a growing concern within the
> open source community.
>
> One effective way to combat the influx of bogus CVEs and ensure
> accurate vulnerability reporting is for open source projects to become
> their own CVE Numbering Authority (CNA). As a CNA, your project gains
> control over the CVE assignment process.
>
> Taking ownership of your project's as a CNA ensures that you are in
> control of the CVE assignment. There will be some requirements to it,
> sure thing. Check
> https://openssf.org/blog/2023/11/27/openssf-introduces-guide-to-becoming-a-cve-numbering-authority-as-an-open-source-project/
I totally agree that all "major" open source projects should become a
CNA, and strongly recommend taking back control over stuff like this.
But, for "smaller" open source projects, it would be _great_ if a root
CNA could become the default for all of open source so that we don't
have the problem where any CNA can assign CVEs against any random
software without any repercussions.
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
