Return to Answer

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author), I apply for a CVE before notifying the vendor.

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it. It would leave you uncertain if you are affected by one or two vulnerabilities.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immidiate risk.

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author), I apply for a CVE before notifying the vendor.

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it. It would leave you uncertain if you are affected by one or two vulnerabilities.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immediate risk.

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author), I apply for a CVE before notifying the vendor.

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immidiate risk.

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author), I apply for a CVE before notifying the vendor.

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it. It would leave you uncertain if you are affected by one or two vulnerabilities.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immidiate risk.

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author, I apply for a CVE before notifying the vendor.

CVE Numbering Authorities (CNAs) are organizations from around the world that are authorized to assign CVEs to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities. These CVEs are provided to researchers, vulnerability disclosers, and information technology vendors. -- https://cve.mitre.org/cve/cna.html

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immidiate risk.

When I find a vulnerability for a product that is not handled by a CNA (CVE Number Author), I apply for a CVE before notifying the vendor.

My reasoning to do it this way, is that now I can ask the vendor to make reference to the CVE in the security advisory/release note. And in turn, the CVE can now make a direct reference to the vendors security advisory/release note.

For the second question, I do not believe the confirmation has to come from the vendor in question. If that was the case, one would not be able to issue a CVE for products that are no longer maintained.

Remember, the purpose of a CVE is to uniquely identify a specific vulnerability. Imagine how two different vulnerability scanners would identify the same vulnerability if there was no common reference for it.

So any published material that describe or confirm a vulnerability could be used, as long it is capable of providing enough details to uniquely identify it. In contrast, if a vendor acknowledges a vulnerability, it is beyond doubt that the vulnerability exists, without having providing intricate details that could put others in immidiate risk.