Re: Issuing CVEs for PHP

On Sun, Apr 28, 2019 at 11:51 PM Stanislav Malyshev <smalyshev@gmail.com> wrote: > I have set up PHP as CNA (CVE Identifiers authority) with MITRE. That > means that we will be assigning our own CVEs from now on. The process in > broad strokes works like this: > > 1. We request a block of numbers > 2. When we have security bug, we use one of the numbers in the block > 3. We create CVE descriptions and commit them to the cvelist repo > > Much more detailed documentation on how it is done is here: > https://wiki.php.net/cve > > So far I am the only one who is registered to commit CVE descriptions to > MITRE upstream repo, but if somebody wants to do it too, I'm sure it can > be arranged. > Note that you can assign CVE to a bug not yet fixed or published in the > open. Please use this capability responsibly and keep the tracking in > https://wiki.php.net/cve . If you are not familiar with the > process or > don't want to bother, just put "needed" as CVE number and it will be > taken care of. Please not enter the bug details into the public repo > before the fix is released. > Thank you, Stas, for arranging this autonomy. We should probably have at least three MITRE committers, to raise our bus factor. Phar's had a rash of secbugs lately, so I can participate as part of the phar remediation workflow, though I'd be quite happy to defer to anyone else.