[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4f3997f3e03dbb65de4884a6c27110833560ffec.camel@sambull.org>
Date: Wed, 10 Jun 2026 15:43:09 +0100
From: Sam Bull <9m199i@...bull.org>
To: oss-security@...ts.openwall.com
Subject: Re: How to request CVE numbers?
They did say they already requested CVEs that way.
I just asked some Github staff about the current situation, and apparently May was the
highest volume month ever. So, there's a backlog they're trying to work through and catch
up.
Someone also pointed me to this guide if you wanted to become a CNA yourself:
https://sethmlarson.dev/security-developer-in-residence-weekly-report-17#becoming-a-cve-numbering-authority-as-an-open-source-project
Hopefully the Github team will catch up soon and get back to their usual timeliness.
- Sam
On Wed, 2026-06-10 at 11:27 +0000, Marcus Meissner wrote:
> Hi,
>
> I concur, if you use github, its easiest workflow wise to use the Github
> Security Advisories and their CVE allocation ability.
>
> Ciao, Marcus
> On Wed, Jun 10, 2026 at 05:36:03PM +0800, swing sze wrote:
> > HI,
> >
> > https://github.com/openwrt/odhcpd/security
> >
> > Are you using the GitHub Security Advisor feature to submit CVEs?
> >
> >
> > Hauke Mehrtens <hauke@...ke-m.de> 于2026年6月10日周三 16:59写道：
> >
> > > Hi,
> > >
> > > How to get a CVE number as a community driven open source project
> > > (OpenWrt)? We do not have a security department or a big company backing
> > > us.
> > >
> > > Multiple security problems were reported to OpenWrt in the last few
> > > months. We want to assign CVE numbers to these problems, but have
> > > problems requesting numbers.
> > >
> > > We contacted mitre in the past, but did not got a response within 2
> > > weeks. Using github security advisories worked fine 2 months ago, we got
> > > a CVE number in some days. Currently this does not work any more, we are
> > > already waiting for 1 week.
> > >
> > > How to get a CVE number?
> > >
> > > We (OpenWrt) are a community driven open source project and got multiple
> > > reports from individuals and organizations like OpenAI.
> > >
> > > We requested multiple CVE Numbers on github for this project:
> > > https://github.com/openwrt/odhcpd
> > >
> > > Hauke
> > >
>
Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
