Hi @poc-effectiveness,

GitHub is not the assigning CNA for this CVE. To ensure all CVE users receive the information, you will need get the CVE record updated. Please contact the assigning CNA at cveform.mitre.org.

Let us know if you need assistance with this!

Hi @JonathanLEvans,

Thank you for your response! We will follow your suggestion and contact the assigning CNA to request updates to the CVE record.

In the meantime, we would like to consult on two follow-up questions, as we’ve encountered several similar cases during our analysis:

1. For cases like this one, where a version affected by the vulnerability is not included in the NVD reports, does GitHub Advisory Database only allow updates after confirmation from the assigning CNA?

2. In some other cases, we observed that the affected version is already listed in the NVD report, but not correctly reflected in the GitHub Advisory Database. In such cases, is CNA confirmation still required to update the GitHub advisory?

We understand that updating through the CNA can be a lengthy process, so we’d like to clarify these points in advance to better coordinate our future submissions.

Thanks again for your guidance and support!

Best regards