Does a documentation bug elevate to CVE status?

[Jeffrey Walton <noloader () gmail com>]

Hi Everyone,

Please forgive my ignorance and hair splitting. We were talking with
the Debian Security Team and FW alerted us to a gap in our
documentation. The gap is simple: we handle sensitive information and
did not tell users that they must define -DNDEBUG when using alternate
build systems, like Autotools or CMake. The project's supported build
system, [GNU] Make, adds the define.

The higher level concern is assert is a debugging and diagnostic aide
that eventually raises a SIGABRT. We use them for debugging and
diagnostics for development. During production, the assert is expected
to be removed with NDEBUG and a C++ throw() follows.

If the assert is _not_ removed, then machinery could engage that
egresses the sensitive information to the file system (core files and
the like). On some platforms, like Ubuntu with Apport, Apple with
CrashReporter, and Windows with Windows Error Reporting, the sensitive
information is egressed to a third party (multiple; the platform
provider and the developer).

We know entities like Apple, Google, Microsoft and  app developers
receive the information; see for example, the comment at
https://github.com/weidai11/cryptopp/pull/172#issuecomment-218705068.

So my question is, does a documentation bug elevate to CVE status?

Thanks in advance,

Jeff