Re: How to request a CVE for open source projects

[Kurt H Maier <khm () sciops net>]

On Mon, May 22, 2017 at 06:53:42PM -0600, Kurt Seifried wrote:
> On 2017-05-22 5:44 PM, Kurt H Maier wrote:
> Neither, that's part of what I'm figuring out. Most likely it'll look
> like a trusted pool of people (aka CVE Mentors) that can either
> contribute or more easily gatekeep). Also the doc are out of date and
> the process is evolving rapidly so I haven't really bothered updating
> them since things keep changing.

It might be worth noting that in the README file on the documentation
repo.  It wouldn't take long and may prevent confusion in the meantime.

> Good question. What exactly is it you want to input? CVE requests? CVE
> assignments? Modify existing CVE entries?

Primarily, freeform discussion of the sort that occurred on this list as
a natural outcropping of the CVE request process led to people linking
to verification code, temporary mitigations, highlighting of incomplete
fixes, and the sort of information that was requested earlier in this
thread.  This ability to easily chip in to ongoing situations wasn't
just useful for mitre staff doing CVE work, it was also useful for the
"community of practice" looking for the latest information regarding
self-defense.  I've prevented more than one attack thanks to a one-off
reply from someone in response to a CVE request.  

The CVE assignment process was more than just a collaborative
database-population effort.  With the shift to webforms and javascript
the natural environment which promoted that discourse is being removed.

> Not really. the docs are out of date and I'm more concerned about
> evolving this right now then updating documentation.

Again, I strongly suggest you note on the README that this is the case.
As matters stand the documentation represents itself as accurate.

khm