Excessive CVE Assignment Backlog and Delay in GHSA Process

[Xerodium]

🏷️ Discussion Type

Product Feedback

💬 Feature/Topic Area

Other

Discussion Details

Although it is well documented by GitHub themselves in their security blog here, I need to provide feedback on how slow the CVE allocation has been for myself.

I have been waiting over a month for a high severity CVE related to medical software and although an update is rolled out we can't publish the advisory due to the lack of that final validation. I have noticed similar discussions popping up in the following areas:

• CVE not assigned for 24 days?
• Long delay in CVE assignment

As some feedback, I believe the following needs to happen:

• Remove the 72 hours stated at https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories#cve-identification-numbers as this is becoming verifiably incorrect.
• Increase the amount of staff and automated triage. I agree with their sentiment of valuing quality over speed but these delays are hurting global cybersecurity.
• Provide more transparency on where a GHSA is, with potential categories like received -> backlog -> initial validation -> final verification -> publication -> assigned or however you want to cut it.
• Once you have done the following + the good points raised in the blog post, providing an update on that.

Pointing out the obvious but the current GHSA vulnerability reporting system is, in their own system, broken. Heck, I'd join the team as an analyst just to improve triage speeds.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[ghostinhershell]

Hi @Xerodium,

Thanks so much for sharing your feedback in the Community. Unfortunately, due to (as you've noted) a significant increase in CVE publication requests across the industry, we're currently processing records in the order they're received, with a turnaround of approximately five weeks.

Feedback around updating turnaround times in our Docs has been passed along to our curation team and the documentation is in the process of being updated to reflect challenges related to dramatically increased demands on the GitHub CNA.

[Xerodium]

Thanks @ghostinhershell appreciate this. As shown in the screenshot for one of my CVE's I'm over 5 weeks right now so definitely can personally vouch on that. The vulnpocalapse is here https://sitehost.nz/blog/linux-cves-400, and can only hope this blows over soon, lest this just become the new normal...

[Xerodium]

Hi @ghostinhershell sorry to bother you on this however is the 5 week approximation still accurate. Been waiting just over six weeks for GHSA-r3wq-wqh4-3rpg. Both the maintainer and I have both fixed and rolled out a patch for this many weeks ago