Timeline for What to do if a vendor does not assign a CVE for an acknowledge vulnerability?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 16, 2017 at 16:56 | comment | added | Kurt | Not sure why you would involve CERT in a CVE matter. MITRE is the ultimate authority for CVE (they run the program, create the root CNAs, etc.). As you can see from cve.mitre.org/cve/cna.html with everything documented here: cve.mitre.org/cve/cna/CNA_Rules_v1.1.pdf please note these guidelines are being updated to this specific link will be out of date (hopefully soon =). | |
| Aug 15, 2017 at 15:46 | comment | added | WhiteWinterWolf | MITRE seems to focus exclusively on products which have no dedicated CNA ("Vulnerabilities in CNA products must be sent to the vendor in question"), so I have the impression that such request will be either dropped or blindly forwarded to the CNA in charge of the product. In case of a real trouble with a CNA, isn't it better to contact a CERT instead ("involve disagreement or dispute between reporters and vendors")? | |
| May 17, 2016 at 20:31 | history | answered | Kurt | CC BY-SA 3.0 |