What to do if a vendor does not assign a CVE for an acknowledge vulnerability?

Question

We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas).

We notified the company, they acknowledged the problem and they are going to release a patch for it.

We specifically asked to have a CVE assigned to the vulnerability we found, but they replied giving us an internal "bug identifier".

Is this a "normal" behavior?

How can we get a CVE if they do not assign one to the bug we found?

Thanks

Answer 1

Most likely they would like to release a patch before making a public CVE. If they released a public CVE before they patched it would only hurt themselves, as the current version would be open to attack. Once they release a patch and are able to notify their customers, then I would expect that they would release a CVE to get the general public caught up.

Answer 2

Getting a CVE and "releasing it" doesn't mean exploitation will happen, they'd also have to release details on the vulnerability. Also it is less then ideal to go "CVE shopping" when one CNA isn't playing nice, if that occurs please go directly to Mitre, [email protected] and notify them so they can poke the CNA and if no movement then hopefully Mitre would assign the CVE.