Add a guide for submitting CVE requests

Author: timlegge

docs/guides/cve-submission-guide.md

@@ -0,0 +1,69 @@
+# CVE Submission Guide
+This is a guide to submitting a CVE request to the CPAN Security CNA (CVE
+Numbering Authority).
+
+# Contacting the CNA
+Send an email to cve-request@security.metacpan.org
+
+# Reserving a CVE Identifier
+If you have found a potential vulnerability in the scope of the CNA you can
+request a CVE identifier.  
+
+In most cases you will be asked to provide the details of the vulnerability
+before a CVE identifier will be issued.  However, a CPAN author or Perl
+Security may **reserve** a CVE number without providing details.  The CVE
+identifier will be reserved and the requester will be recorded.
+
+# Publishing a CVE
+A previously reserved CVE identifier or a new CVE may be published.  To publish
+a CVE the CNA requires the following minimal information:
+
+1. The name of software that contains the vulnerability
+2. The version or versions impacted
+3. Description of the issue
+
+Optionally you can also provide:
+
+1. URLs that provide references or show the affected code
+2. Potential mitigations of fixes
+3. A JSON file generated by [Vulnogram](https://vulnogram.github.io/)
+
+# Research the CVE database to ensure it has not been logged previously
+
+Ensuring that the issue has not been previously logged is very important.
+Duplicate entries will merely serve to confuse the issue and polute the CVE
+database.
+
+1. Access [Mitre.org CVE Search](https://cve.mitre.org/cve/search_cve_list.html)
+1. Search for various keywords including but not limited to the distribution or
+module name and any applicable words.
+1. Review the results
+1. If the CVE appears to be previously submmitted you can ask the CNA to decide
+whether it is the same issue.
+
+# Example data to provide
+
+This is an example of information to submit for a CVE with the Foo::Bar
+distribution.
+
+* Name of the software
+
+    Foo-Bar CPAN distribution
+
+* Impacted versions
+    Affected range: <0.99
+
+* Description
+    Foo::Bar uses the rand() function for cryptographic purposes.
+
+* URL refenrencs:
+    https://example.com/foo_bar/vulnerability.html
+
+* Mitigations
+    Upgrade to 1.00 or higher
+
+* Discoverer
+    If you want to be credited (on more importantly do not want to be publicly
+    credited) please indicate that.
+
+Informtation can be included in an email to cve-request@security.metacpan.org