Streamlining CVE assignment for glibc

[Jeff Law]

On 10/02/2015 02:37 AM, Florian Weimer wrote:
> We have trouble obtaining CVE assignments for already-public
> vulnerabilities in glibc.
>
> Here's a recent request to MITRE which has remained unprocessed for weeks:
>
>    <http://openwall.com/lists/oss-security/2015/09/08/2>
>
> (This does not affect assignment for privately-reported vulnerabilities.
>   We can CVE IDs from CNAs such as Red Hat and Debian.  However, once an
> issue is public, assignment has to go through MITRE.)
>
> I want to change that for glibc, and receive authority (personally, for
> myself) to assign IDs for public glibc issues, as they are documented in
> Sourcware Bugzilla.  I am already familiar with the assignment process,
> so I think it's natural that I take care of this matter, but if anyone
> else wants to share responsibility for this, I'm happy to collaborate.
> I do not plan to make glibc a full CNA, though, which means we need to
> rely on other organization's assignment pools in the background (Debian
> and Red Hat, for now).
>
> Lack of CVE assignment makes security tracking more complicated, and may
> even force downstreams who backport our fixes to release security
> advisories without CVE IDs, which in turn causes grief for end users.
>
> What do you think?
I'm not really wired into glibc, but it seems like a no-brainer to me 
given your interests, background and likely assignments for Red Hat :-)

jeff