When you find a vulnerability, do you contact CVE assigners before contacting the vendor or after the vendor has fixed the problem?
PS: do not link to How are CVE identifiers assigned and managed?, as it doesn't answer my question.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You can request a CVE number without the details being published.
The timeline I have previously followed is:
I consider the CVE guys reasonably trustworthy, and I will disclose high-level details of the vulnerability to them before I published. They need this to avoid duplicates, but you can tell them to keep details private. If someone searches for the CVE at this point, it just says "reserved". When I publish, I copy the CVE guys and they then update the CVE entry to include the information.
You do need to get the CVE before you publish - it's pretty much essential to include a CVE number on your advisory.
As far as I know, you first contact the vendor. There are numerous CVE requests on the oss-security mailing list pointing to bug trackers. Of course if a vendor ignores the issue that's a different story...
I suspect your question has more to do with whether it's ethical to disclose without warning a vendor?
If you apply for a CVE ID and are granted one, then the vulnerability will become public knowledge. It is recommended that you first contact the software developer and wait 30 days for their response. Depending on the severity of the vulnerability, they may ask that you do not make the vulnerability known to the public until they have had time to patch.
Overall, the course you take is your decision. But working with the vendor will ensure you are not held liable for damages releasing the vulnerability may cause.
If the vendor in question is a CNA (CVE Numbering Authority) then when you report a vulnerability to them they should promptly assign it a CVE # (this is standard operating procedure at Red Hat). If they fail to assign it a CVE then I would advise going to Mitre at firstname.lastname@example.org.
If the vendor is not a CNA then you can request a CVE from Mitre at email@example.com. Personally I prefer that the vulnerability get a CVE sooner rather then later (it makes tracking and coordination easier).