{"action":"created","comment":{"url":"https://api.github.com/repos/nodejs/security-wg/pulls/comments/172328597","pull_request_review_id":101327606,"id":172328597,"diff_hunk":"@@ -102,6 +102,16 @@ regular basis.\n Members of this team are required to follow the same NDA and privacy measures\n as the [Node.js Security Team](https://github.com/nodejs/security-wg/blob/master/processes/security_team_members.md).\n \n+# Use of CVEs and reference\n+\n+Every vulnerability disclosed by the triage team through HackerOne must\n+be assigned a CVE number.\n+\n+Vulnerabilities disclosed to this repository without going through triage\n+do not need to be assigned a CVE number.","path":"processes/third_party_vuln_process.md","position":10,"original_position":10,"commit_id":"befd4d4f1f94c1cfe4e70b32348823df38b85b66","original_commit_id":"befd4d4f1f94c1cfe4e70b32348823df38b85b66","user":{"login":"mhdawson","id":9373002,"avatar_url":"https://avatars3.githubusercontent.com/u/9373002?v=4","gravatar_id":"","url":"https://api.github.com/users/mhdawson","html_url":"https://github.com/mhdawson","followers_url":"https://api.github.com/users/mhdawson/followers","following_url":"https://api.github.com/users/mhdawson/following{/other_user}","gists_url":"https://api.github.com/users/mhdawson/gists{/gist_id}","starred_url":"https://api.github.com/users/mhdawson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhdawson/subscriptions","organizations_url":"https://api.github.com/users/mhdawson/orgs","repos_url":"https://api.github.com/users/mhdawson/repos","events_url":"https://api.github.com/users/mhdawson/events{/privacy}","received_events_url":"https://api.github.com/users/mhdawson/received_events","type":"User","site_admin":false},"body":"How about \"Vulnerabilities disclosed to this repository without using HackerOne currently cannot be assigned a CVE by the triage team (we are working to resolve this) but may have a CVE number if was assigned by another entitiy.","created_at":"2018-03-05T21:08:04Z","updated_at":"2018-03-05T21:08:04Z","html_url":"https://github.com/nodejs/security-wg/pull/138#discussion_r172328597","pull_request_url":"https://api.github.com/repos/nodejs/security-wg/pulls/138","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/comments/172328597"},"html":{"href":"https://github.com/nodejs/security-wg/pull/138#discussion_r172328597"},"pull_request":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/138"}},"in_reply_to_id":171376863},"pull_request":{"url":"https://api.github.com/repos/nodejs/security-wg/pulls/138","id":172052581,"html_url":"https://github.com/nodejs/security-wg/pull/138","diff_url":"https://github.com/nodejs/security-wg/pull/138.diff","patch_url":"https://github.com/nodejs/security-wg/pull/138.patch","issue_url":"https://api.github.com/repos/nodejs/security-wg/issues/138","number":138,"state":"open","locked":false,"title":"clarify use of CVE for ecosystem","user":{"login":"vdeturckheim","id":7135896,"avatar_url":"https://avatars0.githubusercontent.com/u/7135896?v=4","gravatar_id":"","url":"https://api.github.com/users/vdeturckheim","html_url":"https://github.com/vdeturckheim","followers_url":"https://api.github.com/users/vdeturckheim/followers","following_url":"https://api.github.com/users/vdeturckheim/following{/other_user}","gists_url":"https://api.github.com/users/vdeturckheim/gists{/gist_id}","starred_url":"https://api.github.com/users/vdeturckheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdeturckheim/subscriptions","organizations_url":"https://api.github.com/users/vdeturckheim/orgs","repos_url":"https://api.github.com/users/vdeturckheim/repos","events_url":"https://api.github.com/users/vdeturckheim/events{/privacy}","received_events_url":"https://api.github.com/users/vdeturckheim/received_events","type":"User","site_admin":false},"body":"This PR aims at clarifying when we want to issue a CVE and when we don't need it for the ecosystem vulnerabilities.\r\n\r\nWDYT @nodejs/security-wg ?\r\n\r\ncc @ChALkeR ","created_at":"2018-02-28T19:42:40Z","updated_at":"2018-03-05T21:08:04Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f5157205042240b9edd831a34cecf13fffee84e1","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/nodejs/security-wg/pulls/138/commits","review_comments_url":"https://api.github.com/repos/nodejs/security-wg/pulls/138/comments","review_comment_url":"https://api.github.com/repos/nodejs/security-wg/pulls/comments{/number}","comments_url":"https://api.github.com/repos/nodejs/security-wg/issues/138/comments","statuses_url":"https://api.github.com/repos/nodejs/security-wg/statuses/befd4d4f1f94c1cfe4e70b32348823df38b85b66","head":{"label":"vdeturckheim:clarify_cve_usage","ref":"clarify_cve_usage","sha":"befd4d4f1f94c1cfe4e70b32348823df38b85b66","user":{"login":"vdeturckheim","id":7135896,"avatar_url":"https://avatars0.githubusercontent.com/u/7135896?v=4","gravatar_id":"","url":"https://api.github.com/users/vdeturckheim","html_url":"https://github.com/vdeturckheim","followers_url":"https://api.github.com/users/vdeturckheim/followers","following_url":"https://api.github.com/users/vdeturckheim/following{/other_user}","gists_url":"https://api.github.com/users/vdeturckheim/gists{/gist_id}","starred_url":"https://api.github.com/users/vdeturckheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdeturckheim/subscriptions","organizations_url":"https://api.github.com/users/vdeturckheim/orgs","repos_url":"https://api.github.com/users/vdeturckheim/repos","events_url":"https://api.github.com/users/vdeturckheim/events{/privacy}","received_events_url":"https://api.github.com/users/vdeturckheim/received_events","type":"User","site_admin":false},"repo":{"id":123331965,"name":"security-wg","full_name":"vdeturckheim/security-wg","owner":{"login":"vdeturckheim","id":7135896,"avatar_url":"https://avatars0.githubusercontent.com/u/7135896?v=4","gravatar_id":"","url":"https://api.github.com/users/vdeturckheim","html_url":"https://github.com/vdeturckheim","followers_url":"https://api.github.com/users/vdeturckheim/followers","following_url":"https://api.github.com/users/vdeturckheim/following{/other_user}","gists_url":"https://api.github.com/users/vdeturckheim/gists{/gist_id}","starred_url":"https://api.github.com/users/vdeturckheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdeturckheim/subscriptions","organizations_url":"https://api.github.com/users/vdeturckheim/orgs","repos_url":"https://api.github.com/users/vdeturckheim/repos","events_url":"https://api.github.com/users/vdeturckheim/events{/privacy}","received_events_url":"https://api.github.com/users/vdeturckheim/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/vdeturckheim/security-wg","description":"Node.js Security Working Group","fork":true,"url":"https://api.github.com/repos/vdeturckheim/security-wg","forks_url":"https://api.github.com/repos/vdeturckheim/security-wg/forks","keys_url":"https://api.github.com/repos/vdeturckheim/security-wg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/vdeturckheim/security-wg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/vdeturckheim/security-wg/teams","hooks_url":"https://api.github.com/repos/vdeturckheim/security-wg/hooks","issue_events_url":"https://api.github.com/repos/vdeturckheim/security-wg/issues/events{/number}","events_url":"https://api.github.com/repos/vdeturckheim/security-wg/events","assignees_url":"https://api.github.com/repos/vdeturckheim/security-wg/assignees{/user}","branches_url":"https://api.github.com/repos/vdeturckheim/security-wg/branches{/branch}","tags_url":"https://api.github.com/repos/vdeturckheim/security-wg/tags","blobs_url":"https://api.github.com/repos/vdeturckheim/security-wg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/vdeturckheim/security-wg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/vdeturckheim/security-wg/git/refs{/sha}","trees_url":"https://api.github.com/repos/vdeturckheim/security-wg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/vdeturckheim/security-wg/statuses/{sha}","languages_url":"https://api.github.com/repos/vdeturckheim/security-wg/languages","stargazers_url":"https://api.github.com/repos/vdeturckheim/security-wg/stargazers","contributors_url":"https://api.github.com/repos/vdeturckheim/security-wg/contributors","subscribers_url":"https://api.github.com/repos/vdeturckheim/security-wg/subscribers","subscription_url":"https://api.github.com/repos/vdeturckheim/security-wg/subscription","commits_url":"https://api.github.com/repos/vdeturckheim/security-wg/commits{/sha}","git_commits_url":"https://api.github.com/repos/vdeturckheim/security-wg/git/commits{/sha}","comments_url":"https://api.github.com/repos/vdeturckheim/security-wg/comments{/number}","issue_comment_url":"https://api.github.com/repos/vdeturckheim/security-wg/issues/comments{/number}","contents_url":"https://api.github.com/repos/vdeturckheim/security-wg/contents/{+path}","compare_url":"https://api.github.com/repos/vdeturckheim/security-wg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/vdeturckheim/security-wg/merges","archive_url":"https://api.github.com/repos/vdeturckheim/security-wg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/vdeturckheim/security-wg/downloads","issues_url":"https://api.github.com/repos/vdeturckheim/security-wg/issues{/number}","pulls_url":"https://api.github.com/repos/vdeturckheim/security-wg/pulls{/number}","milestones_url":"https://api.github.com/repos/vdeturckheim/security-wg/milestones{/number}","notifications_url":"https://api.github.com/repos/vdeturckheim/security-wg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/vdeturckheim/security-wg/labels{/name}","releases_url":"https://api.github.com/repos/vdeturckheim/security-wg/releases{/id}","deployments_url":"https://api.github.com/repos/vdeturckheim/security-wg/deployments","created_at":"2018-02-28T19:28:48Z","updated_at":"2018-02-28T19:18:32Z","pushed_at":"2018-03-02T22:45:39Z","git_url":"git://github.com/vdeturckheim/security-wg.git","ssh_url":"git@github.com:vdeturckheim/security-wg.git","clone_url":"https://github.com/vdeturckheim/security-wg.git","svn_url":"https://github.com/vdeturckheim/security-wg","homepage":null,"size":285,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"nodejs:master","ref":"master","sha":"f400ee0a6ebcad31fb73f378d9a545ea5285e796","user":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars3.githubusercontent.com/u/9950313?v=4","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"repo":{"id":75093520,"name":"security-wg","full_name":"nodejs/security-wg","owner":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars3.githubusercontent.com/u/9950313?v=4","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/nodejs/security-wg","description":"Node.js Security Working Group","fork":false,"url":"https://api.github.com/repos/nodejs/security-wg","forks_url":"https://api.github.com/repos/nodejs/security-wg/forks","keys_url":"https://api.github.com/repos/nodejs/security-wg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nodejs/security-wg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nodejs/security-wg/teams","hooks_url":"https://api.github.com/repos/nodejs/security-wg/hooks","issue_events_url":"https://api.github.com/repos/nodejs/security-wg/issues/events{/number}","events_url":"https://api.github.com/repos/nodejs/security-wg/events","assignees_url":"https://api.github.com/repos/nodejs/security-wg/assignees{/user}","branches_url":"https://api.github.com/repos/nodejs/security-wg/branches{/branch}","tags_url":"https://api.github.com/repos/nodejs/security-wg/tags","blobs_url":"https://api.github.com/repos/nodejs/security-wg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nodejs/security-wg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nodejs/security-wg/git/refs{/sha}","trees_url":"https://api.github.com/repos/nodejs/security-wg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nodejs/security-wg/statuses/{sha}","languages_url":"https://api.github.com/repos/nodejs/security-wg/languages","stargazers_url":"https://api.github.com/repos/nodejs/security-wg/stargazers","contributors_url":"https://api.github.com/repos/nodejs/security-wg/contributors","subscribers_url":"https://api.github.com/repos/nodejs/security-wg/subscribers","subscription_url":"https://api.github.com/repos/nodejs/security-wg/subscription","commits_url":"https://api.github.com/repos/nodejs/security-wg/commits{/sha}","git_commits_url":"https://api.github.com/repos/nodejs/security-wg/git/commits{/sha}","comments_url":"https://api.github.com/repos/nodejs/security-wg/comments{/number}","issue_comment_url":"https://api.github.com/repos/nodejs/security-wg/issues/comments{/number}","contents_url":"https://api.github.com/repos/nodejs/security-wg/contents/{+path}","compare_url":"https://api.github.com/repos/nodejs/security-wg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nodejs/security-wg/merges","archive_url":"https://api.github.com/repos/nodejs/security-wg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nodejs/security-wg/downloads","issues_url":"https://api.github.com/repos/nodejs/security-wg/issues{/number}","pulls_url":"https://api.github.com/repos/nodejs/security-wg/pulls{/number}","milestones_url":"https://api.github.com/repos/nodejs/security-wg/milestones{/number}","notifications_url":"https://api.github.com/repos/nodejs/security-wg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nodejs/security-wg/labels{/name}","releases_url":"https://api.github.com/repos/nodejs/security-wg/releases{/id}","deployments_url":"https://api.github.com/repos/nodejs/security-wg/deployments","created_at":"2016-11-29T15:16:52Z","updated_at":"2018-03-05T00:56:55Z","pushed_at":"2018-03-05T20:34:15Z","git_url":"git://github.com/nodejs/security-wg.git","ssh_url":"git@github.com:nodejs/security-wg.git","clone_url":"https://github.com/nodejs/security-wg.git","svn_url":"https://github.com/nodejs/security-wg","homepage":null,"size":292,"stargazers_count":35,"watchers_count":35,"language":null,"has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":20,"mirror_url":null,"archived":false,"open_issues_count":26,"license":null,"forks":20,"open_issues":26,"watchers":35,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/138"},"html":{"href":"https://github.com/nodejs/security-wg/pull/138"},"issue":{"href":"https://api.github.com/repos/nodejs/security-wg/issues/138"},"comments":{"href":"https://api.github.com/repos/nodejs/security-wg/issues/138/comments"},"review_comments":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/138/comments"},"review_comment":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/138/commits"},"statuses":{"href":"https://api.github.com/repos/nodejs/security-wg/statuses/befd4d4f1f94c1cfe4e70b32348823df38b85b66"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"mhdawson"}}