CVE Assignment Process for Fixed Vulnerability

[ay-kay]

Hello,

I recently reported a vulnerability (Huntr Bounty Link) which has been fixed by the maintainer and is now listed in the GitHub Advisory Database. However, I noticed that no CVE ID has been assigned to it yet.

Could you please provide guidance on the process to have a CVE ID assigned to this advisory? Is there any additional information or action needed from my side?

Thank you for your assistance!

[taladrane]

hello @ay-kay! 👋 I'm the manager of the GitHub open source CNA team within the Lab and can provide guidance for you. As a CNA, we only assign CVE IDs to code owners when they request them from us as part of disclosing using a GitHub repository security advisory. We don't require a CVE ID for a repo or global GHSA, nor do we automatically assign a CVE ID to all repo GHSAs. The primary reasons for this are:

• GitHub users are welcome to use any CNA that they wish, meaning that they can include CVE IDs on their advisories that originate outside of GitHub. In this instance, it would've allowed you to include a CVE ID assigned by huntr if they chose. If we assigned a CVE ID to every repo GHSA, it would significantly increase the likelihood of scope overlap and duplicate CVE assignments with other CNAs to a level that we couldn't reasonably manage.
• Users can create repo GHSAs to disclose security-related information for their end users that don't align with CVE rules. The most common examples of this that I see are when a maintainer creates an advisory to inform their community that the project is no longer being maintained, which is outside the CVE assignment guidelines, and advisories stating that the project contains a vulnerability due to a vulnerable dependency, which typically should have a CVE ID assigned to the most upstream issue. Automatic assignments in this case would also lead to unmanageable scope overlap and an increase in duplicate CVE assignments, violating the rules.

Given that the maintainer has been unresponsive in this case, it unfortunately seems unlikely that you'll be able to have them create a repository GitHub Security Advisory to then request a CVE ID from my team. I saw in the huntr thread that MITRE had previously rejected your request due to scope overlap with huntr. I suspect that the feedback you received about scope overlap may not be quite right, given that huntr made a public statement saying that they will not assign, but CNAs of Last Resort like MITRE should be able to.

I'd encourage you to make another request to MITRE, explicitly denote that the CNA whose scope covers this project has elected not to assign and will allow another CNA to, and feel free to include this discussion as a reference. I'll also take the action to personally flag this discussion to the MITRE CVE team for review to get you some more support!