3 ms·
There are other CVE numbering authorities you can report a vulnerability to and apply for a CVE, or appeal, but this does possibly have a chilling effect if the
by fulafel 1y ago
There are other CVE numbering authorities you can report a vulnerability to and apply for a CVE, or appeal, but this does possibly have a chilling effect if the vendor's CNA refuses valid vulns. (Like with MS in https://news.ycombinator.com/item?id=44957454 https://news.ycombinator.com/item?id=44957454 )
There's an appeals process: https://www.cve.org/Resources/General/Policies/CVE-Record-Dispute-Policy.pdf https://www.cve.org/Resources/General/Policies/CVE-Record-Di...
And of course CVE is not the only numbering system, there's OSV DB, GHSA, notcve.org etc.
- jorams 1y ago> this does possibly have a chilling effect if the vendor's CNA refuses valid vulns The Linux kernel went in the opposite direction: Every bugfix that looks like it could be relevant to security gets a CVE[1]. The number of CVEs has increased significantly since it became a CNA. [1]: https://lwn.net/Articles/978711/ https://lwn.net/Articles/978711/
- fulafel 1y agoThanks. They seem to be pretty proactive indeed if you look at the feed: https://lore.kernel.org/linux-cve-announce/ https://lore.kernel.org/linux-cve-announce/