curl Project Discusses CVE Allocation Process and Severity Assessment as a CNA

curl as a CVE Numbering Authority

The curl project became a CVE Numbering Authority (CNA) several years ago, granting it the ability to allocate its own CVE identifiers for security problems within its scope. This allows the project to decide which issues receive a CVE, streamlining the process and avoiding external dependencies.

Streamlined CVE Publication

Since becoming a CNA, the curl project has published 57 security vulnerabilities with associated CVE identifiers. The process for obtaining a CVE is described as quick and efficient, requiring only an API call to generate a new number. This efficiency is attributed to the project's existing vulnerability management processes and its lean security team.

Vulnerability Assessment and Severity Grading

For each reported issue, the curl project first assesses if it constitutes a security vulnerability. If confirmed, the issue is graded into LOW, MEDIUM, HIGH, or CRITICAL severity from a pure curl perspective, without considering specific user environments. The project acknowledges that users might rate the impact differently based on their specific use cases.

Withholding CVEs for Minimal Risk

The curl project occasionally identifies issues with a "lower than LOW" severity, where the risk is considered minuscule due to extreme requirements and convoluted steps for exploitation. In such cases, the project opts not to issue a CVE, aiming to avoid unnecessary security activities for issues unlikely to affect users in practice.

The Cost of a CVE

With libcurl installed in an estimated thirty billion instances globally, each published CVE triggers significant activity across many security teams worldwide, leading to patches and software updates. The project highlights that every CVE carries a substantial cost in terms of these global efforts, a cost that does not fall on the curl project itself.