Creating security advisory and requesting CVE through fork? (or alternatives)

[Marcono1234]

Background

At the beginning of the year I reported a vulnerability to a maintainer and contributed a fix. The maintainer published a new release containing the fix soon after.

The problem is since then how to create a security advisory and to request a CVE.
For historical reasons the maintainer only has "Member" permissions for the repository, but can push changes and publish releases to the package registry of the ecosystem. However, to enable GitHub's private vulnerability reporting "Owner" permission is needed.

So to me and the maintainer it looked like MITRE was the right CNA to approach. I submitted the CVE request on February 1st but never got a response since then¹. In my last mail to MITRE in July I mentioned to them that I might try another CNA, but also did not get a response there.

Therefore I went looking for other CNAs which accept reports for open source projects and found Snyk. However, I did not get any response from them either and in the meantime they changed their policy to not accept reports for open source projects anymore, see https://snyk.io/report-a-vulnerability/.

So now I am still in the situation that the vulnerability has been fixed about 10 months ago but there is still no advisory nor CVE for it.
For what it's worth, the bug is not some minor issue which can barely be considered a vulnerability, it is a memory safety issue for which other projects affected by the same issue got a CVSS severity of "High".

Caution

Please don't try to guess which project this is about and especially don't mention the project here or anywhere else publicly. It would just be a waste of your and my time, since the whole point of this here is to disclose it, but properly.

Question

So my question is now, can I just create a fork of the repository, enable private vulnerability reporting there, create the advisory, invite the maintainer and then finally publish the advisory (to make it appear in the global GitHub advisory database eventually) and request a CVE?

Also, what will happen if I then delete my fork; will that break things for the advisory?

I know that this is not the 'proper' way, but everything else failed so far (as mentioned above), and I am also not that keen on continuing to wait any further for MITRE to respond maybe¹.

Or what alternatives exist? Given the large increase in advisories and CVEs I doubt that there still is any other CNA which accepts CVE requests for open source projects.

The last resort would of course be to just publish a repository advisory in my fork (or create some kind of write-up), and then hope that some CNA somehow through social media or some other means becomes aware of it and publishes the CVE.
But then it is up to that CNA what information they include and whether they omit information, and I am afraid the CVE (or GitHub advisory) might not properly credit me then, and at this point after all the work and trouble with this that would be rather annoying.

Footnotes

1. Could of course also be an e-mail problem on their or my side. Though other mails regarding a technical issue during the initial submission attempt did reach MITRE and they resolved the issue rather fast. It is hard to figure out what the state of the CVE request is, if it is still in the queue, how long the estimate for it to be processed is, ... when the only way to obtain this information is through mail. ↩ ↩²

[shelbyc]

Hi @Marcono1234, GitHub doesn't issue CVEs to forks that are created for security research purposes. The only time we consider issuing a CVE to a forked project is if the original project is unmaintained and the fork is being actively maintained, rather than just created for fixing a specific bug or conducting security research.

There are a number of other CNAs that accept vulnerability reports from independent security researchers, including Vulncheck (which primarily operates in AMER time zones) and VulDB (which primarily operates in EMEA time zones).

[Marcono1234]

Thanks, that is really helpful!

Do you have any experience with Vulncheck or VulDB and know how long they need to process reports or whether they are overloaded by the increase of CVEs as well?
I would like to avoid the same situation I had with Snyk (mentioned above) where I am waiting forever for a response just to notice by accident that they stopped accepting reports for open source projects in the meantime.

[shelbyc]

I haven't worked with VulDB extensively but know them to be generally timely. As it turns out, I'm at a conference with several VulnCheck people today and showed them this thread. They told me to have you email disclosure@vulncheck.com (the email on their CNA page) and they'll keep an eye out for your message.