Recently, I had someone report an arbitrary code execution vulnerability in Aegisub. It was a pretty simple vuln, but consequential enough that I thought it was worthwhile to put out a security advisory and a CVE. If you’re curious, the actual issue is here.
GitHub advertises their security advisory system as a no-brainer for devs already on the platform. The platform makes it simple to write up the incident, associate it with versions/commits, communicate with everyone involved in the process, maintain a private branch, and various other niceties. Honestly, it’s a well thought out product, and I have no real complaints with this aspect. It’s nice!
GitHub is also a CVE Numbering Authority (CNA), and they encourage you to request the CVE within the product. Theoretically, this is a great experience! It’s certainly easy to fill out their form and hit the button. This reserves the number for your vuln after it’s approved (which their docs claim is usually under 72 hours), and when you publish the advisory it updates with the details so that downstream consumers such as distros can pick it up automatically (again, within 72 hours).
Unfortunately, they aren’t anywhere near those time windows. Not even close. It took me three weeks to get the initial number, and has gotten dramatically worse since, judging by other commentary online. The latest issue in that list has GitHub staff estimating five weeks as the turnaround time. After publishing, I’m not sure how long it normally takes GitHub to update the register with the full details. In my case, it went past the CVE program’s mandated 72-hour deadline, at which point I contacted support to speed it up due to the urgency around packaging.
What to do? Well, for one, GitHub should definitely update their docs to reflect something closer to reality. Had I known I would face these kinds of delays, I would have used a different CNA, or at least investigated the possibility. I’m not sure how slammed they are, but even a week turnaround time would be a blessing compared to my experience here. These delays can hold up publishing fixes, which matters because the vulnpocalypse is here, and it’s very, very real.
In addition, GitHub needs to find some way to expedite this process. Manual review of all submissions is noble, and hiring is hard, but at this point I think it’s more harmful than helpful to request these through GitHub. If I can’t get a CNA to issue me a number in less than a week, I’m just going to publish without, and anyone not on a rolling-release distro will suffer since they won’t have the fixes backported. Maybe there’s a partnership to be had? I really don’t know, but we need a real fix, because this is clearly not going to work as the flood of vulnerabilities continues.