3 ms·
It used to be that anybody could issue CVE for anything, which lead to some pretty bad CVEs. But now there's a CNA program in place, and has been for several ye
by smsm42 3y ago
It used to be that anybody could issue CVE for anything, which lead to some pretty bad CVEs. But now there's a CNA program in place, and has been for several years, where the organization can register as a CVE source for a product or a set of products, and nobody would be issuing CVEs for those products. Not sure how 2020 CVE even got in the system - you shouldn't be able to reserve 2020 CVE now, so it appears as if somebody got a CVE ID reserved three years ago and just decided for some reason to publish it as curl CVE. Not sure if the current system has any protections against such abuse...
- smsm42 3y agoLooks like cURL team is not in the list of CNAs: https://www.cve.org/PartnerInformation/ListofPartners https://www.cve.org/PartnerInformation/ListofPartners - maybe they should be. The measure of the last resort for bad CVEs is https://cveform.mitre.org/ https://cveform.mitre.org/ as I understand.
- darksim905 3y agoCNA?
- cratermoon 3y agoCVE Numbering Authorities. Not quite a recursive acronym.
- smsm42 3y agoPlease check out: https://www.cve.org/ProgramOrganization/CNAs https://www.cve.org/ProgramOrganization/CNAs