Reducing Ratio of Reserved But Public CVEs
summary
GitHub moves from under 5,000 advisories to over 177,000 advisories, and building automation around the CVE Services API makes the concrete claim that requesting IDs as-needed, publishing records immediately, and running a year-end rejection and publishing sweep cuts reserved-but-public (RBP) counts. New CNA rules impose a 72-hour publication requirement after public disclosure; delayed examples include CVE‑2021‑32850 (published ~one year late) while a recent case is published on March 11, 2024, showing the combined practices work.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:02Reserved but public CVEs
- 2:06Speaker’s GitHub role
- 4:36GitHub advisory growth
- 7:27Record store lessons
- 13:15CVE backlogs and prioritization
- 16:32Why reserved CVEs matter
- 24:19Minimizing excess reserved CVEs
- 31:30CVE disclosure policy
- 34:47Lessons learned
- 38:21Q&A
related talks
31mA Glimpse Into OSS Vulnerability Disclosure Practices
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
39mSecurity Advisory Programs: Creating Transparency Along the Software Supply Chain
51mNo More Secrets in Cybersecurity: Implementing ‘Radical Transparency’
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
24mSecurity Advisories and Vulnerability Prioritization in the Wild
45mFuture of CVE
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures