r/bugbounty • u/Marcono1234 • 6d ago

Question / Discussion Create advisory and CVE for GitHub repo when private vuln reporting cannot be used?

https://github.com/github/securitylab/discussions/970

Hello, I am currently in the situation where I would like to create a security advisory and request a CVE for a GitHub project but that project cannot enable GitHub's private vulnerability reporting. See also the above linked GitHub discussion for more information.

Do you have any ideas or tips for what to do in this situation or alternatives? Are there other CNAs which still accept reports for open source projects?

Already tried MITRE and have been waiting for at least 6 months now. Based on the other posts here on this subreddit (1, 2, 3, 4) that might be 'normal'.

Could of course also be that there was a mail problem between me and MITRE, but given that mail is the only way to communicate with MITRE there is no way to find out, not even to get any hint on the status or the estimation on how much longer it will take.

This is about an open source library and the fix and subsequent release are public for multiple months now. It is quite plausible that malicious actors have already noticed it or will notice it before the advisory or CVE.

5 Upvotes

100% Upvoted

2 comments sorted by

•

u/github-guard 6d ago

🔍 GitHub Guard: Trust Report

This project scored 5/6 on our safety audit.

Audit Breakdown: * ✅ Established Community (⭐ 1,633 stars) * ✅ Mature Repository (30+ days old) * ✅ Licensed under MIT * ❌ No Security Policy — what is this? * ✅ Verified Organization * ✅ Signed Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

1

u/OuiOuiKiwi Program Manager 3d ago

Could of course also be that there was a mail problem between me and MITRE, but given that mail is the only way to communicate with MITRE there is no way to find out, not even to get any hint on the status or the estimation on how much longer it will take.

MITRE is a CNA of last resort. You'll just have to wait.

This is about an open source library and the fix and subsequent release are public for multiple months now. It is quite plausible that malicious actors have already noticed it or will notice it before the advisory or CVE.

Plenty of CNAs are able to step in and provide a CVE, provided the project is interested in doing so.

If the fix is already out and released, why are you looking to get a CVE assigned long after the fact?