2

I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it.

According to the procedure explained here: https://cve.mitre.org/cve/request_id.html#cna_participants, I will need to contact a CNA. But none of the listed CNAs seem to cover GNU Scientific Library. What can I do?

3

First off, don't forget to contact the authors of the library (pick the appropriate contact from the list) so that they issue a fix by the time the CVE is fully disclosed.

If the product affected by the vulnerability is not covered by a CNA in the list (and the GNU Scientific Library certainly isn't), you need to contact the CNA of Last Resort.

There are two of them, but in your case, again, I'd go with MITRE itself: here's the form. I have positive experience working with them on a vulnerability disclosure and CVE number assignment.

2
  • Thanks. Does it help to include the fix when requesting a CVE? What if the bug is only confirmed but not fixed? – zell Dec 2 '20 at 19:47
  • Then the publication of the CVE could be further delayed until there's a fix. That's not for ages, that would only result in a reasonable delay, but still. And it's a mannerly thing to give some time to the developers to fix their mistakes. – ximaera Dec 3 '20 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.