Versions Compared

Old Version 13

changes.mady.by.user Eric Hatleback

Saved on

compared with

New Version 14

changes.mady.by.user Eric Hatleback

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

If a vendor is unresponsive, the CERT/CC will attempt to elicit participation from the vendor, but the CERT/CC can coordinate disclosure and publish a vulnerability note without the vendor's involvement.

...

The report status will be "pending" when you initially submit your vulnerability report. The status will change to "open" once we accept the report for coordination and assign an associated VU# tracking number. "Closed" indicates that the CERT/CC has either not accepted the report for coordination, or coordination is complete. "Published" means that the CERT/CC has published a vulnerability note associated with the case to kb.cert.org.

...

You can edit your initial vulnerability report until we have accepted or declined the report for coordination. Once the status of your initial vulnerability report leaves the "pending" status, you will be unable to edit your report. If you need to provide the CERT/CC with more information, you can add a comment to the vulnerability report, post in the open case discussion, or send the CERT/CC a direct private message.

How do I ask the CERT/CC to reconsider a closed case?

You can add a comment to the closed VRF# report with any additional information that you think is relevant for reconsideration, including new vulnerability details or a change in vendor cooperation.

Will the CERT/CC give me a CVE ID?

The CERT/CC may assign CVEs to vulnerabilities that we actively coordinate, but typically only after vendor(s) have declined to do so. Reporters may always request a CVE ID by contacting the CVE Program directly using cveform.mitre.org, so if you are attempting to obtain a CVE ID for your report, we suggest starting there.

...

If another reporter should be added to the case, please send the CERT/CC a direct private message with the user's VINCE account information, including the email address.

Who else can see my report?

If the CERT/CC accepts the vulnerability report for coordination, any participant added to the case (including vendors) will be able to see your initial report.