As was
recently announced,
the Linux kernel project has been accepted as a CNA as a CVE Numbering
Authority (CNA) for vulnerabilities found in Linux.
This is a trend, of more open source projects taking over the haphazard
assignments of CVEs against their project by becoming a CNA so that no other
group can assign CVEs without their involvment. Here’s the
curl project
doing much the same thing for the same reasons. I’d like to point out the
great work that the
Python project
has done in supporting this effort, and the
OpenSSF project
also encouraging it and providing documentation and help for open source
projects to accomplish this. I’d also like to thank the
cve.org group and board as they all made the application
process very smooth for us and provided loads of help in making this all
possible.