Requesting CVE for an unresponsive maintainer

[acepace]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Code quality

Discussion Details

There's a large open-source project where I notified the maintainer through an email about a high severity vulnerability. The security issue has been fixed, but the maintainer claims they don't have time to create an advisory or register a CVE.
What are my options in this case? I want to register a CVE so I can push others to upgrade their dependency.

[sgdev-official]

Ah, I see you're looking at that GitHub discussion about what to do when a maintainer fixes a security issue but refuses or doesn't have time to request a CVE. That's actually a pretty common bottleneck in open-source security!

If you're ever in that exact position—or if you're looking at how to handle it yourself—here are your main options:

1. Request a CVE through a CNA (CVE Numbering Authority)

   • If the project's maintainer won't do it, you can request a CVE yourself as a third-party reporter.
   • You can submit a request directly through the CVE Program's official website (or via a CNA of last resort like GitHub Security Advisories if the repo is hosted on GitHub).

2. Publish a detailed advisory independently

   • Even without a CVE ID immediately, you can write up a thorough disclosure or blog post detailing the vulnerability, affected versions, and the patched version.
   • Share it on platforms like GitHub Security Advisories or security mailing lists so dependent projects and security scanners (like Dependabot) can pick it up.

3. Contribute the advisory draft directly to the maintainer

   • Sometimes maintainers say "no time" because filling out vulnerability forms feels like bureaucratic overhead. You can make it frictionless by drafting the entire security advisory or CVE request template for them, so all they have to do is click submit.

[MrFabry]

You can get one without the maintainer, but who you ask depends on who covers the project.

First check whether the project is already covered by a CNA. Some big projects or their foundations are CNAs themselves (Apache, Eclipse, the Linux kernel, plenty of vendors), and if so the request has to go to them. The partner list on cve.org lets you search by scope. GitHub also won't assign one if another CNA covers the project.

If it's on GitHub, the easiest route is making it a two-click job for the maintainer. If private vulnerability reporting is enabled (Security tab > Report a vulnerability), file it there with everything filled in: affected versions, fixed version, the fix commit, severity. You get added as a collaborator on the advisory, and all they have to do is accept it, hit Request CVE and publish. Only someone with admin rights on the advisory can request the CVE, so you can't do that last bit yourself, but you can do all the writing. If reporting isn't enabled it's one setting in the repo's security settings, which is a much smaller ask than "write an advisory".

If they still won't, or it's not on GitHub, and no other CNA covers it, MITRE is the CNA of last resort and takes requests from researchers directly: https://mitre.github.io/mitre-cve-roles/cve-id-request/ (cveform.mitre.org redirects there now). Have the fix commit, the release that contains it and your email thread with the maintainer ready. It can take a while.

One more thing, since your goal is getting people to upgrade. Once the CVE is published it shows up in the GitHub Advisory Database automatically from NVD, but as unreviewed, and Dependabot doesn't alert on unreviewed advisories. Open a PR on github/advisory-database adding the package, ecosystem and affected version ranges. Once it's reviewed, Dependabot alerts go out to everyone depending on it.

[acepace]

You can get one without the maintainer, but who you ask depends on who covers the project.

First check whether the project is already covered by a CNA. Some big projects or their foundations are CNAs themselves (Apache, Eclipse, the Linux kernel, plenty of vendors), and if so the request has to go to them. The partner list on cve.org lets you search by scope. GitHub also won't assign one if another CNA covers the project.

If it's on GitHub, the easiest route is making it a two-click job for the maintainer. If private vulnerability reporting is enabled (Security tab > Report a vulnerability), file it there with everything filled in: affected versions, fixed version, the fix commit, severity. You get added as a collaborator on the advisory, and all they have to do is accept it, hit Request CVE and publish. Only someone with admin rights on the advisory can request the CVE, so you can't do that last bit yourself, but you can do all the writing. If reporting isn't enabled it's one setting in the repo's security settings, which is a much smaller ask than "write an advisory".

If they still won't, or it's not on GitHub, and no other CNA covers it, MITRE is the CNA of last resort and takes requests from researchers directly: https://mitre.github.io/mitre-cve-roles/cve-id-request/ (cveform.mitre.org redirects there now). Have the fix commit, the release that contains it and your email thread with the maintainer ready. It can take a while.

One more thing, since your goal is getting people to upgrade. Once the CVE is published it shows up in the GitHub Advisory Database automatically from NVD, but as unreviewed, and Dependabot doesn't alert on unreviewed advisories. Open a PR on github/advisory-database adding the package, ecosystem and affected version ranges. Once it's reviewed, Dependabot alerts go out to everyone depending on it.

It's a common python library hosted on Github. So not sure if Pypi/PSF or Github

[MrFabry]

Most likely neither.

The PSF is a CNA, but its scope is a fixed list: CPython, pip and the Pallets projects (Flask, Jinja, Werkzeug, Click, MarkupSafe, ItsDangerous, Quart), see https://www.python.org/cve-numbering-authority/. It doesn't cover PyPI packages in general, so unless it's one of those they won't assign it.

GitHub does cover projects hosted there, but only through the repo's own security advisory, requested by someone with admin rights on it. So that route only works if the maintainer clicks the button, which is why I suggested filing the private report for them.

If they won't, it's MITRE with the form I linked. Say it's a PyPI package, link the repo, the fix commit and the release, and mention the maintainer was notified and fixed it but won't file anything. That's exactly the case the last-resort CNA is for.

For the upgrade side there's also a Python-specific database besides GitHub's: the PyPA advisory database. You add an entry with a PR, and it feeds pip-audit, OSV and the PyPI JSON API, so anyone running pip-audit gets flagged. Once you have the CVE, add it to the entry as an alias.