2

I may have found a security bug in GNU Scientific Library (https://www.gnu.org/software/gsl/) and would like to request a CVE ID number with it.

According to the procedure explained here: https://cve.mitre.org/cve/request_id.html#cna_participants, I will need to contact a CNA. But none of the listed CNAs seem to cover GNU Scientific Library. What can I do?

Improve this question

1 Answer 1

Reset to default
2

First off, don't forget to contact the authors of the library (pick the appropriate contact from the list) so that they issue a fix by the time the CVE is fully disclosed.

If the product affected by the vulnerability is not covered by a CNA in the list (and the GNU Scientific Library certainly isn't), you need to contact the CNA of Last Resort.

There are two of them, but in your case, again, I'd go with MITRE itself: here's the form. I have positive experience working with them on a vulnerability disclosure and CVE number assignment.

Improve this answer
2
  • Thanks. Does it help to include the fix when requesting a CVE? What if the bug is only confirmed but not fixed?
    – zell
    Commented Dec 2, 2020 at 19:47
  • Then the publication of the CVE could be further delayed until there's a fix. That's not for ages, that would only result in a reasonable delay, but still. And it's a mannerly thing to give some time to the developers to fix their mistakes.
    – ximaera
    Commented Dec 3, 2020 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .