DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
We have some tooling to make it easier to create advisories in a structured way: as PMC, you can self-allocate a CVE Id at https://cveprocess.apache.org/allocatecve and collaborate on the advisory there.
Write a good description
Ideally a description has 4 components:
- describe whether the issue can be exploited only by authenticated attackers, or by any unauthenticated attacker
- describe how an operator can determine whether they're affected
- describe the impact is of a successful attack,
- recommend what mitigations or fixes they can apply.
...
The CVE record lifecycle
A CVE record in the ASF CVE tool moves through four states:
| State | What it means | Who/what advances into it |
|---|---|---|
| DRAFT | ID reserved, content still being filled in. Not on cve.org. | Set at allocation. |
| REVIEW | Content complete; ready for ASF Security Team / CNA review. Reviewers may leave comments. Not on cve.org. | Advanced when the record body is complete and the fix is about to ship (see Timing below). |
| READY | Content final, review feedback addressed, staged for the advisory email send. Not on cve.org. | A human (release manager) clicks this once reviewer comments are closed. |
| PUBLIC | Pushed to the global CVE database via the CNA feed. World-readable. | Advanced after the advisory email has been sent and archived on the project's public lists — that archive is the signal the advisory actually shipped. |
Timing relative to the release
- Advance a record to REVIEW only when the fix is about to ship — e.g. while the release candidate is being voted. Advancing populated records to REVIEW well ahead of the release forces reviewers to keep pushing them back.
- Send the advisory emails only after the fixed release is public.
- Move to PUBLIC only after the advisory email is archived on the project's public announce/users lists - make sure to add public mailing list url with the advisor as "vendor-advisory" link before moving to PUBLIC.
Description quality checklist
The published description is what operators read to answer "does this affect us, and what do we do?" A complete description satisfies all of:
Get a review
The Apache Security Team is happy to review your advisories! Change the CVE to the 'REVIEW' state to request a review. After the review the Security Team will might move the CVE back to DRAFT state, but it is not necesary for you to act on the reivew comments.
Send the notification emails
Always preview before sending. Use the #email tab to preview the advisory exactly as it will be sent — same subject, body, and recipient list — before pressing Send these Emails. The preview catches formatting defects (truncation, broken markdown, missing patch links).
Once the fixes are released and you're happy with the advisory, you can send the notification emails with the 'Send these Emails' button on the 'OSS/ASF Emails' page.
...