[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ai931NCbF-SPpQAu@eldamar.lan>
Date: Mon, 15 Jun 2026 05:56:04 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: How to request CVE numbers?
Hi,
On Thu, Jun 11, 2026 at 02:56:36AM +0000, Securin Disclose wrote:
> Hello,
>
> As a CVE Numbering Authority (CNA), Securin can reserve and assign CVE IDs for
> your reported vulnerabilities. Once fixes are available, please share the
> complete vulnerability details with us. Our team will review the information and
> publish the CVEs accordingly.
>
> Our current turnaround times are:
>
> CVE Assignment: Within 24 hours
> Publication to MITRE: Within 48 hours after receiving the required details and
> confirming readiness for disclosure
>
> Please let us know how we can assist in streamlining or accelerating the CVE
> assignment process for your team. We are happy to work closely with you to
> ensure timely coordination, assignment, and publication.
>
> We look forward to supporting your vulnerability disclosure efforts.
Out of interest, since I was looking up the scope of the Securin CNA.
The scope currently say:
| Vulnerabilities found in Securin products and services (including
| end-of-life/end-of-service products), as well as vulnerabilities in
| third-party software discovered by Securin that are not in another
| CNA’s scope.
So does that not only cover vunerabilities in third-party software
(not CNA's scope) discoveed by Securin? The Red Hat CNA OTOH covers
explicitly open source in their root scope:
https://www.cve.org/PartnerInformation/ListofPartners/partner/securin
https://www.cve.org/PartnerInformation/ListofPartners/partner/redhat
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
