Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101915
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.52 as permitted sender)
To: PHP Internals <internals@lists.php.net>,
 "security@php.net" <security@php.net>
Message-ID: <d44451c7-15d5-edf0-4056-cd4ade8ac73d@gmail.com>
Date: Fri, 23 Feb 2018 15:58:21 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:59.0)
 Gecko/20100101 Thunderbird/59.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Subject: Setting up CNA for PHP CVEs
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

I've been complaining in the past about the way PHP CVE are handled -
they are sometimes issued with no coordination with anybody from PHP
developers, sometimes contain misleading and outright wrong information
and sometimes disregard our guidelines for security issues
(https://wiki.php.net/security). Fortunately, it looks like now there is
a way to properly fix it.

In order to do that, I've decided to apply for CNA for PHP project - see
more on CNAs here: https://cve.mitre.org/cve/request_id.html - which
would make PHP developers the official authority for issuing CVEs for PHP.

In order to do that, we would need one or more people to be set up as
CVE mentors, as described here:
https://github.com/distributedweaknessfiling/DWF-CVE-Mentor-Registry/blob/master/README.md
I plan to register myself as one, but if anyone wants to volunteer
please step up. I have already contacted Kurt Seifried about it, and got
initial instructions (which are pretty much starting with filling the
mentorship forms) and would like to continue the setup, but if somebody
wants to join in helping things please tell me.

Also please tell me if you have any concerns or comments about this.

Thanks,
-- 
Stas Malyshev
smalyshev@gmail.com