Does downstream software that inherits vulnerable code need its own CVE submission?

Question

A vulnerability could spread from one software to downstream software projects that import/use the software. If the original software has already requested a CVE ID and disclosed the vulnerability to the public, does its downstream software also need to report the vulnerability and request separate CVE IDs for their own projects on the same vulnerability?

This likely would lead to a huge amount of duplicate records in the vulnerability database. However, I also could not find an official language or reporting guidelines on the CVE website that explicitly indicates that downstream software should not report vulnerabilities caused by their dependencies.

For example, if my software project imports an external software library that disclosed a vulnerability, do I need to request a CVE ID for my own software and report a vulnerability that I once imported to the vulnerable library in my software that made my software vulnerable?

Answer 1

If that was the case, you would have ~zillions CVEs each time a CVE in, for example, OpenSSL was published, and there were a few of those :)

So no, as far as I know in most cases, any downstream software (meaning: software using the affected component) should only take care of publishing the appropriate security bulletin / guidance, notifying that it is affected by the relevant CVE, provide instructions for mitigation and/or patching, etc. Referencing the CVE ID is enough and that's part of what it's there for.

Having said that, I do think there are cases, where the CVE interacts with a specific downstream component in a way that can create a vulnerability which is different enough in its attack surface, security implications, etc. to justify creating a new CVE, so as to appropriately document and describe the new vulnerability. Obviously, this is mostly not the case.

I think you can find more information here:

Can CVEs (or any vulnerability) be dependent on one another?

Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?