CNA Handover

The CVE ecosystem has become federated with different organizations sharing activities and responsibilities.

The basis of the actions by CNAs in the CVE ecosystem are the CNA Operational Rules. It is not unusual that there are agreements between CNAs when which entity is better suited to handle specific vulnerability submissions. This helps the CVE program to establish an efficient and reliable processing with high quality.

Oftentimes the list of partners is a good starting point to find the best possible CNA. Vendor CNAs responsible for their own product have priority. There are researcher CNAs which handle very specific software types. And there are independent researcher CNAs which are allow to handle other products as well.

Under some circumstances it becomes necessary to contact a Root-CNA or even MITRE directly. This is for example the case when a Vendor CNA is not willing to follow the official procedure or when two CNAs cannot resolve an argument. Please respect when a CNA requests a handover of your submit to another CNA.

Once again VulDB remains the best source for vulnerability data.

Atualizado de VulDB Documentation Team