I found a vulnerability in a library of vendor A, I reported it, they fixed it and I received a CVE.
We noticed that some application (let's call it vendor B), contained the library of vendor A, we reported it, he updated the application with the fixed library and release it with a new version.
Should vendor B also assign a CVE to its application?
He told me that he will write in the change log of the fix, that it addresses the CVE of vendor A.
Both applications are open-source.
What is usually the process in such thing?
I thought that any program that has a vulnerability, even if they contained a vulnerable library, should assign a CVE when they fix and release a new version of their application. In such case, if the vulnerable library affects 1000 applications, should all the 1000 application report the CVE? I suppose not but I don't know.