What is our SLA for going from reserved CVE to published CVE?

[Carlos O'Donell <carlos@redhat.com>]

Raising this on libc-alpha for a broader discussion.

For CVE-2024-33599, CVE-2024-33600, CVE-2024-33601 and CVE-2024-33602
the glibc security team has not yet published the CVE IDs, only reserved
the block.

I have just completed filling in the advisories and have all the data
for publishing them along with publishing the CVE IDs [1].

I could have published the CVE IDs *earlier* but my reading of the CNA
rules is that:
~~~
2.2.3 SHOULD provide the CVE Record information within 24 hours of
publishing the CVE ID.
~~~

So once I publish the CVE ID I need to move quickly to fill in all the
record information... which I don't have until I complete the
advisory text.

For these CVE IDs it will have been ~7-8 days to publish, which is too
long IMO, but we can improve that.

Under embargo was certainly easier because the timeline gives us time
to write the advisory text and get it ready for publishing.

Would it be better if we just published interm text and updated as we go?

-- 
Cheers,
Carlos.

[1] https://inbox.sourceware.org/libc-alpha/20240502020121.3267018-1-carlos@redhat.com/T/#m749caf9d5b5e7093efe1bb2ae4cb413ec9749ad4