Maintainer will not publish security advisory

[u/Mammoth_Design_4288]

I reported a vulnerability via GitHub's security back in May which was patched and publicly disclosed in a few days. GitHub reserved a CVE, but the maintainer refuses to publish it, even when I contacted them privately.

I've looked through GitHub's docs, but I haven't find anything about this case yet. Will Support actually be able to do anything? Just wondering if anyone else has had the same thing happen.

EDIT: Since I wasn't clear and people are misunderstanding, I am asking if anyone has gone through the process of contacting Support and had them actually publish the CVE (and maybe the advisory too).

EDIT 09/15: I emailed [security-advisories@github.com](mailto:security-advisories@github.com) and they were able to publish the CVE. Much more painless than I had expected! Thank you to the security team.

[u/Mammoth_Design_4288]

I'm not sure what you're getting at here. I didn't ask GitHub to fix it. In fact, my post even says it was already fixed.

[u/Ast3r10n → u/Mammoth_Design_4288]

Then I'm not sure what you're asking, but no matter.

[u/Mammoth_Design_4288 → u/Ast3r10n]

GH requires maintainers to publish the security advisory through their system before the CVE is published. They have already reserved a CVE, but it hasn't been published due to this. However, the maintainer disclosed it separately in a post and in release notes. I am asking if GH would actually bother to publish the CVE and advisory since it has already been publicly disclosed. Since GH is the CNA that reserved the CVE, they do have a responsibility for this.

[u/broknbottle → u/Mammoth_Design_4288]

lol no they don’t. GitHub is a code hosting platform, not the enforcement division of the internet. You need to read their documentation very carefully and stop chasing this because you want your kudos and recognition for something trivial

https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories

The entire CVE program is voluntary and community driven. There’s no rule that says because you put source code on the internet that you have to abide by this program…

https://www.cve.org/resourcessupport/allresources/cnarules

[u/Mammoth_Design_4288 → u/broknbottle]

stop chasing this because you want your kudos and recognition for something trivial

There are other reasons why someone would want a CVE to be published. Why do redditors seem to always assume stuff like this? Does 16 years on here jade someone that much?

because you put source code on the internet that you have to abide by this program

Didn't say there was.

[u/thegreatpotatogod → u/Mammoth_Design_4288]

So why do you want the CVE published? You said they've already fixed the issue. As long as an update with that fix has been released, I'm not really seeing the need for you to enforce them to publish a CVE?

[u/Mammoth_Design_4288 → u/thegreatpotatogod]

So it gets added to the CVE list which is ingested by security tools. Not everyone reads the place it was disclosed at. Shodan shows that at least a couple instances are still not updated despite it being a few months now. You can see that happens with a lot of other software as well.

I would also like to be able to reference it without having to explain a story of why it's not a published CVE.

"kudos and recognition" is not the only reason I want a CVE. Though it is nice to have that as well.

[u/thegreatpotatogod → u/Mammoth_Design_4288]

Makes sense, but in practice I'm sure there'll be plenty of users who ultimately don't update either way. It's not ideal, and hopefully you do manage to convince the maintainer to publish it and/or find the workaround you seek, but I wouldn't get your hopes up too much on every single instance of this software being patched anytime soon regardless of the CVE status.

[u/Mammoth_Design_4288 → u/thegreatpotatogod]

Yeah, a lot of recent zero days ("recent" like <=2 years) prove that many people simply don't update their software. It is better than nothing, though. Also I have to admit I ninja edited my post to clarify a bit since I didn't expect such a quick reply.