Re: Consensus: Security Hall of Fame, Security issue attributions, NEWS, and Contribution Checklist.

[Florian Weimer <fweimer at redhat dot com>]

On 10/21/2015 11:05 PM, Joseph Myers wrote:
> I think we had consensus for Florian to assign CVEs for public security 
> bugs as per <https://sourceware.org/ml/libc-alpha/2015-10/msg00034.html> 

I'm still trying to get permission from MITRE to do this.  I have yet to
receive any kind of response from them.

At present, MITRE does not assign CVE IDs for glibc security
vulnerabilities within a reasonable time frame.  The CVE pools at
Debian, Red Hat, and other distributions can only be used for
not-yet-public issues (but we can make vulnerabilities public
immediately after CVE assignment if the impact is not critical).

Reporters generally want CVE IDs (to list them on their CVs etc.), and
they are really helpful for tracking vulnerabilities downstream.  Right
now, we can get such IDs only if vulnerabilities are reported privately.
 I hope this will change eventually, but in the meantime, in order to
match reporter expectations regarding CVE assignment (and downstream
requirements), we need to nudge them towards private reporting, to the
downstream security contacts listed on the Security Process page.

Florian