Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105495
MIME-Version: 1.0
References: <b6e24bc1-1494-e8f6-2664-67c09931ea23@gmail.com>
In-Reply-To: <b6e24bc1-1494-e8f6-2664-67c09931ea23@gmail.com>
Reply-To: bishop@php.net
Date: Mon, 29 Apr 2019 02:47:48 -0400
Message-ID: <CAEYWF=6XhmYnWd04kA5O_m9LJxnfADUMcX89VPMs+LTJiWwwUQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP Internals <internals@lists.php.net>, "security@php.net" <security@php.net>
Content-Type: multipart/alternative; boundary="0000000000002148ac0587a5abb1"
Subject: Re: [PHP-DEV] Issuing CVEs for PHP
From: bishop@php.net (Bishop Bettini)

--0000000000002148ac0587a5abb1
Content-Type: text/plain; charset="UTF-8"

On Sun, Apr 28, 2019 at 11:51 PM Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> I have set up PHP as CNA (CVE Identifiers authority) with MITRE. That
> means that we will be assigning our own CVEs from now on. The process in
> broad strokes works like this:
>
> 1. We request a block of numbers
> 2. When we have security bug, we use one of the numbers in the block
> 3. We create CVE descriptions and commit them to the cvelist repo
>
> Much more detailed documentation on how it is done is here:
> https://wiki.php.net/cve
>
> So far I am the only one who is registered to commit CVE descriptions to
> MITRE upstream repo, but if somebody wants to do it too, I'm sure it can
> be arranged.
> Note that you can assign CVE to a bug not yet fixed or published in the
> open. Please use this capability responsibly and keep the tracking in
> https://wiki.php.net/cve . If you are not familiar with the process or
> don't want to bother, just put "needed" as CVE number and it will be
> taken care of. Please not enter the bug details into the public repo
> before the fix is released.
>

Thank you, Stas, for arranging this autonomy.

We should probably have at least three MITRE committers, to raise our bus
factor.

Phar's had a rash of secbugs lately, so I can participate as part of the
phar remediation workflow, though I'd be quite happy to defer to anyone
else.

--0000000000002148ac0587a5abb1--