Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.

A strange bottleneck; anyone know why that would be so slow?



https://github.blog/security/supply-chain-security/inside-th... goes into it more

As mentioned by another commenter, they intentionally have a human reviewer in the process before a GitHub Security Advisory (GHSA) becomes "official" post-publish

(this is separate to getting CVE ID assigned, if wanted)


Trying to keep the rest of GH online?


human triage in review




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: