Recent searches
Search options
Perl is now a CNA, able to assign their own CVE ids, this is great news!
https://security.metacpan.org/2025/02/25/cpansec-is-cna-for-perl-and-cpan.html
Just in time for my talk about this very topic in a few weeks about how all open source projects should be doing this:
https://lfms25.sched.com/event/1urXE/take-control-over-your-projects-cve-entries-before-someone-else-does-greg-kroah-hartman-linux-foundation
https://security.metacpan.org/2025/02/25/cpansec-is-cna-for-perl-and-cpan.html
Just in time for my talk about this very topic in a few weeks about how all open source projects should be doing this:
https://lfms25.sched.com/event/1urXE/take-control-over-your-projects-cve-entries-before-someone-else-does-greg-kroah-hartman-linux-foundation
security.metacpan.org · CPANSec is CNA for Perl and the CPAN ecosystemThe CPAN Security Group was authorized by the CVE Program as a CVE Numbering Authority (CNA) on Feb 25, 2025. A CNA assigns and manages CVE identifiers for projects in their scope.
@gregkh I spotted perl has MITRE as root, like most.To me it feels like redhat or something would be a better fit...
@bagder As Red Hat just became a root at the same time Perl became a CNA, odds are that wasn't an option yet. But yes, going forward I think having most/many open source groups be under Red Hat is a good option to help reduce the load on MITRE.
@bagder @gregkh Red Hat has been a root since 2022 (https://www.cve.org/Media/News/item/blog/2022/09/07/CVE-Program-Expands-Partnership-with) and when we made glibc a CNA we picked Red Hat as our root (https://www.cve.org/PartnerInformation/ListofPartners/partner/glibc)