Anyone with admin permissions to a security advisory can publish the security advisory.
Prerequisites
Before you can publish a security advisory or request a CVE identification number, you must create a draft security advisory and provide information about the versions of your project affected by the security vulnerability. For more information, see "Creating a security advisory."
If you've created a security advisory but haven't yet provided details about the versions of your project that the security vulnerability affects, you can edit the security advisory. For more information, see "Editing a security advisory."
About publishing a security advisory
When you publish a security advisory, you notify your community about the security vulnerability that the security advisory addresses. Publishing a security advisory makes it easier for your community to update package dependencies and research the impact of the security vulnerability.
You can also use GitHub Security Advisories to republish the details of a security vulnerability that you have already disclosed elsewhere by copying and pasting the details of the vulnerability into a new security advisory.
Before you publish a security advisory, you can privately collaborate to fix the vulnerability in a temporary private fork. For more information, see "Collaborating in a temporary private fork to resolve a security vulnerability."
When you publish a draft advisory from a public repository, everyone is able to see:
- The current version of the advisory data.
- Any advisory credits that the credited users have accepted.
Note: The general public will never have access to the edit history of the advisory, and will only see the published version.
After you publish a security advisory, the URL for the security advisory will remain the same as before you published the security advisory. Anyone with read access to the repository can see the security advisory. Collaborators on the security advisory can continue to view past conversations, including the full comment stream, in the security advisory unless someone with admin permissions removes the collaborator from the security advisory.
If you need to update or correct information in a security advisory that you've published, you can edit the security advisory. For more information, see "Editing a security advisory."
Requesting a CVE identification number
Anyone with admin permissions to a security advisory can request a CVE identification number for the security advisory.
If you don't already have a CVE identification number for the security vulnerability in your project, you can request a CVE identification number from GitHub. GitHub usually reviews the request within 72 hours. Requesting a CVE identification number doesn't make your security advisory public. If your security advisory is eligible for a CVE, GitHub will reserve a CVE identification number for your advisory. We'll then publish the CVE details after you publish the security advisory. For more information, see "About GitHub Security Advisories."
- On GitHub, navigate to the main page of the repository.
- Under your repository name, click Security.
- In the left sidebar, click Security advisories.
- In the "Security Advisories" list, click the security advisory you'd like to request a CVE identification number for.
- Use the Publish advisory drop-down menu, and click Request CVE.
- Click Request CVE.
Publishing a security advisory
Publishing a security advisory deletes the temporary private fork for the security advisory.
- On GitHub, navigate to the main page of the repository.
- Under your repository name, click Security.
- In the left sidebar, click Security advisories.
- In the "Security Advisories" list, click the security advisory you'd like to publish.
- At the bottom of the page, click Publish advisory.
GitHub Dependabot alerts for published security advisories
GitHub will review each published security advisory, add it to the GitHub Advisory Database, and may use the security advisory to send GitHub Dependabot alerts to affected repositories. If the security advisory comes from a fork, we'll only send an alert if the fork owns a package, published under a unique name, on a public package registry. This process can take up to 72 hours and GitHub may contact you for more information.
For more information about GitHub Dependabot alerts, see "About alerts for vulnerable dependencies." For more information about GitHub Advisory Database, see "Browsing security vulnerabilities in the GitHub Advisory Database."