Skip to content

Revise CVE ID handling guidelines in contributor guide #298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 3, 2025
Merged

Revise CVE ID handling guidelines in contributor guide #298

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions docs/CNA/cna-guide-for-openjs-cna-contributors.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,8 @@
## Reserved CVE ID Handling

### Reserving CVE IDs

- The CNA should have no less than 2 and no more than 5 reserved, unused CVEs at any one time
- An issue must be created and approved in [security-advisories](https://github.com/openjs-foundation/security-advisories) before additional CVE IDs may be reserved

### Managing Reserved CVE IDs
- All reserved CVE IDs are stored in [security-advisories](https://github.com/openjs-foundation/security-advisories)/reserved-cve.md until they are assigned to a CVE Request
CVE IDs shall be reserved on an as-needed basis when a vulnerability determination has been made and public disclosure is expected.
Reserved CVE IDs must be either published within 72 hours of public disclosure or rejected if not used.

### Assigning a CVE ID to a CVE Request
- Comment in the CVE Request issue stating which reserved CVE IDs will be requested to be used
Expand Down