Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105508
MIME-Version: 1.0
References: <b6e24bc1-1494-e8f6-2664-67c09931ea23@gmail.com>
In-Reply-To: <b6e24bc1-1494-e8f6-2664-67c09931ea23@gmail.com>
Date: Mon, 29 Apr 2019 17:24:21 +0300
Message-ID: <CAEsznC4yLtzEGCCM8HUaWh9A+F=c8kw=P_JxGWcG+Onnf+iy3Q@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP Internals <internals@lists.php.net>, "security@php.net" <security@php.net>
Content-Type: multipart/alternative; boundary="0000000000001a64fa0587ac0b5c"
Subject: Re: Issuing CVEs for PHP
From: kaplanlior@gmail.com (Lior Kaplan)

--0000000000001a64fa0587ac0b5c
Content-Type: text/plain; charset="UTF-8"

On Mon, Apr 29, 2019 at 6:51 AM Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> I have set up PHP as CNA (CVE Identifiers authority) with MITRE. That
> means that we will be assigning our own CVEs from now on. The process in
> broad strokes works like this:
>
> 1. We request a block of numbers
> 2. When we have security bug, we use one of the numbers in the block
> 3. We create CVE descriptions and commit them to the cvelist repo
>
> Much more detailed documentation on how it is done is here:
> https://wiki.php.net/cve
>
> Me please (:

--0000000000001a64fa0587ac0b5c--