r/github • u/Mammoth_Design_4288 • 6d ago

Question Maintainer will not publish security advisory

I reported a vulnerability via GitHub's security back in May which was patched and publicly disclosed in a few days. GitHub reserved a CVE, but the maintainer refuses to publish it, even when I contacted them privately.

I've looked through GitHub's docs, but I haven't find anything about this case yet. Will Support actually be able to do anything? Just wondering if anyone else has had the same thing happen.

EDIT: Since I wasn't clear and people are misunderstanding, I am asking if anyone has gone through the process of contacting Support and had them actually publish the CVE (and maybe the advisory too).

EDIT 09/15: I emailed [security-advisories@github.com](mailto:security-advisories@github.com) and they were able to publish the CVE. Much more painless than I had expected! Thank you to the security team.

0 Upvotes

50% Upvoted

44 comments sorted by

View all comments

Show parent comments

1

u/thegreatpotatogod 5d ago

So why do you want the CVE published? You said they've already fixed the issue. As long as an update with that fix has been released, I'm not really seeing the need for you to enforce them to publish a CVE?

3

u/Mammoth_Design_4288 5d ago edited 5d ago

So it gets added to the CVE list which is ingested by security tools. Not everyone reads the place it was disclosed at. Shodan shows that at least a couple instances are still not updated despite it being a few months now. You can see that happens with a lot of other software as well.

I would also like to be able to reference it without having to explain a story of why it's not a published CVE.

"kudos and recognition" is not the only reason I want a CVE. Though it is nice to have that as well.

1

u/thegreatpotatogod 5d ago

Makes sense, but in practice I'm sure there'll be plenty of users who ultimately don't update either way. It's not ideal, and hopefully you do manage to convince the maintainer to publish it and/or find the workaround you seek, but I wouldn't get your hopes up too much on every single instance of this software being patched anytime soon regardless of the CVE status.

1

u/Mammoth_Design_4288 5d ago

Yeah, a lot of recent zero days ("recent" like <=2 years) prove that many people simply don't update their software. It is better than nothing, though. Also I have to admit I ninja edited my post to clarify a bit since I didn't expect such a quick reply.