From d309ff2eca60ea91e0253716bc9fb36e91fcbc41 Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Wed, 7 Oct 2026 19:43:09 -0400 Subject: [PATCH] SECURITY: CVE IDs come from the EEF CNA, which covers hex.pm, not from GitHub GitHub is a CNA but does not assign for a package another CNA covers, and the Erlang Ecosystem Foundation's CNA covers every active package on hex.pm: 0.2.1's CVE request to GitHub (2026-09-23) was never going to be answered. The section now gives the EEF CNA's maintainer process (its points of contact as collaborators on the draft, the ID entered as an existing CVE) and says what happened to 0.2.1's request. Signed-off-by: Ayla Croft --- SECURITY.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index e9bb345..3252981 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -67,9 +67,15 @@ authorizes. ## CVEs -Advisories are published from this repository's GitHub Security Advisories. GitHub is a CVE -Numbering Authority for the repositories it hosts, so a CVE is requested from the advisory -draft when the defect warrants one; Critical and High always do. Published advisories reach +Advisories are published from this repository's GitHub Security Advisories. CVE IDs come from +the [Erlang Ecosystem Foundation's CNA](https://cna.erlef.org/), the CVE Numbering Authority for +every active package on hex.pm (GitHub is a CNA too, and does not assign for a package another CNA +covers). An advisory that warrants one gets one before publication; Critical and High always do. +The EEF CNA's points of contact (@IngelaAndin, @maennchen, @voltone) are added to the draft +advisory as collaborators, the CVE is left as "request later", and the ID they assign is entered +as an existing CVE ([their maintainer process](https://cna.erlef.org/maintainer-process)). +`0.2.1`'s advisory was first requested from GitHub, which cannot assign it, and was then +requested from the EEF CNA. Published advisories reach the GitHub Advisory Database and OSV, which `mix hex.audit` reads. ## Out of scope