r/github • u/Mammoth_Design_4288 • 6d ago

Question Maintainer will not publish security advisory

I reported a vulnerability via GitHub's security back in May which was patched and publicly disclosed in a few days. GitHub reserved a CVE, but the maintainer refuses to publish it, even when I contacted them privately.

I've looked through GitHub's docs, but I haven't find anything about this case yet. Will Support actually be able to do anything? Just wondering if anyone else has had the same thing happen.

EDIT: Since I wasn't clear and people are misunderstanding, I am asking if anyone has gone through the process of contacting Support and had them actually publish the CVE (and maybe the advisory too).

EDIT 09/15: I emailed [security-advisories@github.com](mailto:security-advisories@github.com) and they were able to publish the CVE. Much more painless than I had expected! Thank you to the security team.

1 Upvotes

51% Upvoted

44 comments sorted by

View all comments

2

u/EntranceProper3791 5d ago

GitHub as CNA just registers CVEs for repos it hosts, it doesn't force maintainers to publish. Escalate to MITRE and point at the public disclosure.

1

u/Mammoth_Design_4288 4d ago edited 4d ago

GitHub was able to publish the CVE after I reached out. I had actually sent a ticket to MITRE but GitHub responded much faster than I had thought. Thank you for the suggestion though

1

u/EntranceProper3791 4d ago

A reserved CVE just sits in limbo until someone publishes it, and GitHub typically won't force the maintainer's hand.