3 ms·
Don't some projects already issue their own CVEs?
by tbrownaw 2y ago
Don't some projects already issue their own CVEs?
- detaro 2y agoyes, but it's a hierarchy. If you disagreed with their judgement you could always go up the chain, and MITRE can take the privilege away again if they think a vendor is misusing it.
- gnfargbl 2y agoCNAs [1] are assigned blocks of CVEs and then assign from within that block, but the system only works if there is overall administration of the CVE Program [2]. My concern is that a capture of the administration would become a capture of the entire programme. Looking at the structure, it seems possible that CISA are in a position to prevent any such capture but, given some of the recent positions taken by the US government, we'll need to wait and see how that plays out. [1] https://www.cve.org/ProgramOrganization/CNAs https://www.cve.org/ProgramOrganization/CNAs [2] https://www.cve.org/ProgramOrganization/Structure https://www.cve.org/ProgramOrganization/Structure