Re: Becoming a CVE Naming Authority for your project

[Jeremy Stanley <fungi () yuggoth org>]

On 2025-11-06 12:17:41 -0500 (-0500), Pat Gunn wrote:
[...]
> Hoping I'm not missing something obvious about this concern 
> that'll make me look the fool, but worried that if nobody speaks 
> up about it this will amount to a corporate capture of things that 
> are best not so owned.
[...]

This is part of why projects I work on just apply for assignments 
straight from MITRE, and wait for a while in some cases. We've 
intentionally decoupled our advisory publication process from 
obtaining a CVE so that if it takes them until well after things are 
public then that's still fine with us. Instead we issue an errata 
revision for the advisory to add the CVE identifier later once it's 
finally been assigned.

In the past we've had CVEs assigned to us from interested 
CNA-wielding companies, and end up with duplicates that then need to 
be rejected as a result; so while it would be great to be able to 
prevent that, it sounds like the only way available at the moment is 
to become our own CNA which is more work than we collectively have 
time for.
--
Jeremy Stanley

Attachment: signature.asc
Description: