Re: Issuing CVEs for PHP
| From: | Lior Kaplan | Date: | Mon, 29 Apr 2019 14:24:21 +0000 |
| Subject: | Re: Issuing CVEs for PHP | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-105508@lists.php.net to get a copy of this message | ||
On Mon, Apr 29, 2019 at 6:51 AM Stanislav Malyshev <smalyshev@gmail.com>
wrote:
> Hi!
>
> I have set up PHP as CNA (CVE Identifiers authority) with MITRE. That
> means that we will be assigning our own CVEs from now on. The process in
> broad strokes works like this:
>
> 1. We request a block of numbers
> 2. When we have security bug, we use one of the numbers in the block
> 3. We create CVE descriptions and commit them to the cvelist repo
>
> Much more detailed documentation on how it is done is here:
> https://wiki.php.net/cve
>
> Me please (: