Re: CVE for program distributing vulnerable components ?

[Francis Perron <francisp () google com>]

On Fri, Feb 14, 2020 at 10:55 AM Simon McVittie <smcv () debian org> wrote:
> On Fri, 14 Feb 2020 at 00:11:00 +0100, security minded wrote:
> > I've identified a program whose installer contains components with known
> > CVEs. Should one or several CVE be asked for the installer itself ?
>
> The CVE IDs for the individual vulnerable components are enough to
> describe the vulnerability. You don't need new CVE IDs to describe the
> fact that the installer installs vulnerable components.

To echo Simon's points:

Usually, if the code owner (here, the installer's) can fix it in their
own code to avoid the vulnerability, then you can reach out to ask for
a CVE. That being said, CVE issuing is a subjective science, and the
CNA you end up dealing with may decide not to issue one if it is
already dealt with in the underlying libraries.


Good luck!

-- 
Francis Perron
  Vulnerability Coordination @ Google inc.