Re: Regarding CVE assignments on oss-sec mailing list

Mark,

We have been actively working with the upstream vendor to determine the appropriate number of CVEs for the vulnerabilities in git.  There was no oss-security post from MITRE because the context of MITRE's work was related to previous private communication from and to the upstream vendor.

The information in the initial request (http://seclists.org/oss-sec/2015/q4/37) required us to infer the vulnerabilities from code diffs and vague changelog statements.  Historically, basing CVE assignments on this type of information has proven difficult and error prone. For example, we are not certain if Kurt's assignment of CVE-2015-7545 to "Some protocols (like git-remote-ext) can execute arbitrary code found in the URL" is correct.  The vendor may not officially support the "blindly enable recursive fetch" scenario, i.e. the user is expected to accept the risk of executing a recursive fetch from an untrusted source, and the change should be considered a security hardening feature for the convenience of their users.  MITRE relies on the vendor guidance in these situations.

In the future, we plan to respond quickly to requests like the initial one, asking the requester for the appropriate information needed to assign a CVE ID.  If the Editorial Board members have suggestions on better ways to handle these situations, we would appreciate you input.

--
Jonathan Evans
The CVE Team
The MITRE Corporation