Linux is a CNA
As was recently announced, the Linux kernel project has been accepted as a CNA as a CVE Numbering Authority (CNA) for vulnerabilities found in Linux.
This is a trend, of more open source projects taking over the half-hazard assignments of CVEs against their project by becoming a CNA so that no other group can assign CVEs without their involvment. Here’s the curl project doing much the same thing for the same reasons. I’d like to point out the great work that the Python project has done in supporting this effort, and the OpenSSF project also encouraging it and providing documentation and help for open source projects to accomplish this. I’d also like to thank the cve.org group and board as they all made the application process very smooth for us and provided loads of help in making this all possible.
Update
Also from LF:
-
Linux Kernel Achieves CVE Numbering Authority Status
The GNU/Linux kernel has achieved a significant milestone in open source software security. It has been authorized as a CVE Numbering Authority (CNA) by the CVE Program. Being a CNA enables the GNU/Linux kernel team to manage the vulnerabilities with more accuracy and higher quality in the future.