Re: What is our SLA for going from reserved CVE to published CVE?

[Siddhesh Poyarekar <siddhesh@redhat.com>]

On 2024-05-01 22:12, Carlos O'Donell wrote:
> Raising this on libc-alpha for a broader discussion.
> 
> For CVE-2024-33599, CVE-2024-33600, CVE-2024-33601 and CVE-2024-33602
> the glibc security team has not yet published the CVE IDs, only reserved
> the block.
> 
> I have just completed filling in the advisories and have all the data
> for publishing them along with publishing the CVE IDs [1].
> 
> I could have published the CVE IDs *earlier* but my reading of the CNA
> rules is that:
> ~~~
> 2.2.3 SHOULD provide the CVE Record information within 24 hours of
> publishing the CVE ID.
> ~~~
> 
> So once I publish the CVE ID I need to move quickly to fill in all the
> record information... which I don't have until I complete the
> advisory text.
> 
> For these CVE IDs it will have been ~7-8 days to publish, which is too
> long IMO, but we can improve that.
> 
> Under embargo was certainly easier because the timeline gives us time
> to write the advisory text and get it ready for publishing.
> 
> Would it be better if we just published interm text and updated as we go?

The CVE record tends to have a single line description that identifies 
affected functionality and versions, which I think we should be able to 
deliver when we reserve the CVE.  One thing I haven't tested yet is the 
feature to publish records at a specific future date.  If that works, we 
could make it part of our workflow to add a description at the time of 
CVE number reservation, regardless of embargo state.

Thanks,
Sid