When to ask for a CVE Identifier
CVE Identifiers (also called “CVE names,” “CVE numbers,” “CVE-IDs,” and “CVEs”) are unique, common identifiers for publicly known information security vulnerabilities.
In other words a CVE is an identifier for something that we know is a vulnerability (in other words we have to be sure that it is a vulnerability and not just a hardening issue), and the issue will become public at some point.
In other words as soon as you know something is a security issue, and you can be reasonably certain that the issue will be made public (which may or may not include fixing it) you can get a CVE. In fact it’s much better to get a CVE as early as possible in the process, then the CVE can be used in things like commits that fix the issue, it can be applied to bug entries/issues, and ideally used in Change Logs or release notes when the fix is released.
As for who exactly asks for the CVE there are a few simple rules:
- If the software belongs to an entity that is a CNA (CVE Numbering Authority, e.g. Red Hat, Apache, Microsoft) then you MUST ask the CNA to assign the CVE first, if this does not work you can go to the CNA’s parent (e.g. MITRE) and then ask them.
- If the software belongs to an entity that is NOT a CNA (e.g. most projects) then for Open Source you can either ask the DWF, or MITRE, and for closed source you can ask MITRE. Either the researcher or the project can ask for the CVE, but we do ask that you coordinate so that multiple requests are not sent in.
TL;DR: Anyone can ask for the CVE, we only ask that the request be reasonably certain that it is an actual vulnerability and that they ideally coordinate with the project responsible for the software. We also suggest that the CVE be requested as early on as possible to make coordination and identification easier.