3 ms·
> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to se
by yjftsjthsd-h 2mo ago
> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.
A strange bottleneck; anyone know why that would be so slow?
- htrp 2mo agohuman triage in review
- bobmcnamara 2mo agoTrying to keep the rest of GH online?
- jamietanna 2mo agohttps://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/ https://github.blog/security/supply-chain-security/inside-th... goes into it more As mentioned by another commenter, they intentionally have a human reviewer in the process before a GitHub Security Advisory (GHSA) becomes "official" post-publish (this is separate to getting CVE ID assigned, if wanted)