CVE ID year versus disclosure lag

Question

A CVE identifier in use is not necessarily public at a given time. It gets published when or after the vulnerability is published.

Does this mean that the "year" included in the CVE ID can frequently be years older relative to the year of the first public report of the vulnerability (and therefore to when the CVE ID becomes available for CVE search at MITRE)? Or is there a mechanism to correlate the year with the year of public disclosure within some limits related to public disclosure?

I am NOT refering to examples like CVE-2010-5298 which was assigned or maybe just published in 2014, because the vulnerability itself was in some sense public since 2010, just without any CVE ID.

I am refering to a big hypothetical currently unknown bug that will be filling the headlines throughout 2017 but be labelled CVE-2010-something due to a vendor secretly and knowingly sitting on it for 7 years.

Answer 1

Does this mean that the "year" included in the CVE ID can frequently be years older relative to the year of the first public report of the vulnerability (and therefore to when the CVE ID becomes available for CVE search at MITRE)?

You can search for CVEs as soon as they are assigned. If no details have been published yet, the entry will reflect that:

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

 

I am refering to a big hypothetical currently unknown bug that will be filling the headlines throughout 2017 but be labelled CVE-2010-something due to a vendor secretly and knowingly sitting on it for 7 years.

Yes, this can happen. The entry to a reserved CVE states:

Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.

The entry date is what a CVE ID is based on. The same issue will not receive multiple CVEs (unless an error was made) as it would cause confusion.

Although in practice, if a vendor wants to sit on it, they will not request a CVE. If a researcher requested a CVE, they will likely publish some details if the vendor does not show effort to fix the issue.