Re: What happens in order to get CVE numbers

[Kurt Seifried <kseifried () redhat com>]

You can request a CVE Identifier as soon as you can answer the following
questions:

1) What software is affected? Product name? Product version?
2) What is the problem type? (in some cases we accept "unknown" but you
better have a reproducer that does something nasty like crash the system or
execute code)
3) A description of the issue (which includes affected software. problem
type and ideally the impact)
4) A reference URL, and I know the DWF will accept URL's that don't exist
yet as long as you are trustworthy (e.g. "we will post the advisory at URL
X"), typically for open source something like a link to the issue or the
affected code is more than sufficient.

So yes, you can ask for a CVE well before you commit a fix (and in some
cases before you even fully understand the issue).



On Fri, Jun 2, 2017 at 10:22 AM, Qhdwns123 <qhdwns123 () protonmail com> wrote:

> The developer has not yet patched it.
>
> Can I request CVE before committing?
>
> -------- Original Message --------
> Subject: Re: [oss-security] What happens in order to get CVE numbers
> Local Time: June 3, 2017 12:41 AM
> UTC Time: June 2, 2017 3:41 PM
> From: leo () famulari name
> To: Qhdwns123 <qhdwns123 () protonmail com>
> oss-security () lists openwall com <oss-security () lists openwall com>
>
> On Fri, Jun 02, 2017 at 09:09:09AM -0400, Qhdwns123 wrote:
> > Hi
> >
> > What happens in order to get CVE numbers
>
> In order to get a CVE assignment, you can fill out the CVE request form:
>
> https://cveform.mitre.org/



-- 

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com