We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas).
We notified the company, they acknowledged the problem and they are going to release a patch for it.
We specifically asked to have a CVE assigned to the vulnerability we found, but they replied giving us an internal "bug identifier".
Is this a "normal" behavior?
How can we get a CVE if they do not assign one to the bug we found?