Chainguard starts to publish 50 patches that have no CVE

Chainguard sells open source library software with patches to its customers. On September 28, it starts to disclose defects that AI models found. The defects are in Athena, its intake system. Athena has received more than 40,000 results from more than 500 projects since June. Chainguard also works with CISA, the US cyber agency, to become a CNA (a group that can give CVE ID numbers).

How it works

The first 50 patches have no CVE. The project corrected each defect years before. No person gave it a CVE, and a scanner does not find it. For each defect, Chainguard does 3 steps:

• It will publish the patch as a file in an open repository.
• It will publish an advisory with the versions and the code that the defect touches.
• It sends the patch to all customers when the advisory is live.

The numbers

Chainguard tells that 42% of the results are very important. It tells that it made more than 2,000 patches. It gives no test of how correct the results are.

What is not known

Chainguard will not tell the maintainers before each release. Versions with no warning last week can show one. The CNA step is not done at this time.

Insight: The seller of the patch also starts to name the defect

Chainguard tells that a model can use a patch that all can see to make an exploit in one afternoon. Axios tells that persons at Anthropic and OpenAI think a large AI incident can come in 6 to 12 months. Chainguard reads as a company that wants the point where defects get an ID, and its patches go to its customers first. Monitor if scanner makers use its data.