security: Clarify language around glibc and CNA related work.

Co-authored-by: DJ Delorie <dj@redhat.com>

diff --git a/security.html b/security.html
index 247c576fa9748eadf8f2dc5ea295d3c65ff91cdc..2b73211b8a16dc605d302b20e8a94b2fea2a1215 100644 (file)
--- a/security.html
+++ b/security.html
@@ -127,11 +127,12 @@ directory on the master branch of the glibc git repository.
 
 <p>
 glibc does not yet have a CVE Numbering Authority (CNA), but this may
-change in the future.  For CVEs assigned by the glibc CNA, you may
-contact the security team for any updates you'd like to make. This would
+change in the future.  For glibc CVEs you may contact the security team
+for help with any updates you'd like to make. This would
 include updates to the contents of a CVE advisory or requests to update,
-dispute or reject a CVE.  Please do not contact the security team
-members privately for CNA related requests.
+dispute or reject a CVE.  For CNA related requests please use the mailing
+list to contact the security team members, and not their private email
+addresses.
 </p>
 
 <a id="keys"><h2>GPG Keys</h2></a>