http://www.openwall.com/lists/oss-security/2017/10/12/2 http://www.openwall.com/lists/oss-security/2017/10/12/2 "-> We have not reserved a CVE for this issue a

http://www.openwall.com/lists/oss-security/2017/10/12/2 http://www.openwall.com/lists/oss-security/2017/10/12/2 "-> We have not reserved a CVE for this issue as Apple is a CNA and does not > see it as a security issue. > And here's my main teachable moment. If a CVE Numbering Authority (CNA) does not grant a CVE to an issue (whether it be due to "not a bug" or non responsiveness or whatever) there is a simple process to deal with this. You go to the CNA's parent, a list of CNA's is currently at: https://cve.mitre.org/cve/cna.html https://cve.mitre.org/cve/cna.html in general most current CNA's have MITRE as their parent (we're working on a federated hierarchy but we're in the early stages), so using the form: https://cveform.mitre.org/ https://cveform.mitre.org/ to request a CVE would be your next step. For the Open Source Distributed Weakness Filing (DWF) hierarchy each CNA and sub CNA is registered at: https://github.com/distributedweaknessfiling/DWF-CNA-Registry/tree/master/CNA-Registry https://github.com/distributedweaknessfiling/DWF-CNA-Registr... so essentially you go to the parent and keep working your way up until either you are satisfied, or you hit MITRE and they tell you to take a hike, or give you a CVE. Speaking of which if you are an Open Source project and want to be a CNA, polease contact me and chances are I can set you up in a pretty quick timeframe (faster than I assign CVEs because creating a CNA is a much better ROI of my time than issuing a CVE). ." - via>" Kurt Seifried -- Red Hat -- Product Security -- Cloud"