Re: How to request a CVE for open source projects

[Jeremy Stanley <jeremy () openstack org>]

On 2017-05-22 13:05:34 -0500 (-0500), Michael Catanzaro wrote:
[...]
> How are other people getting open source CVEs right now? Has anybody else
> had luck getting a CVE via DWF? Should I be trying to do this through Red
> Hat instead? Or just by filling out MITRE's CVE form even though we're not
> really supposed to be using it?
[...]

OpenStack's been using MITRE's Web form to the best of our
ability[*] and that seems to be working. Though it also has the side
effect that a MITRE representative has reached out to us asking
whether we'd like to become a CNA (our VMT is still trying to decide
if that's worth pursuing).

[*] https://security.openstack.org/vmt-process.html#send-cve-request
-- 
Jeremy Stanley

Attachment: signature.asc
Description: Digital signature