[Secure-testing-team] What is the policy on registering CVEs for security issues in Debian?

[Petter Reinholdtsen]

I notice quite a lot of security issues from the previous years listed
in the Debian CVE database are still not assigned CVEs:

  % grep XXXX data/CVE/list |cut -d- -f2|sort|uniq -c
      1 1999
      2 2001
      4 2002
      3 2003
      6 2004
    101 2005
     54 2006
     50 2007
     32 2008
     73 2009
     65 2010
      9 2011
  % 

What is the policy regarding CVE assignment for the Debian Testing
security work?

Happy hacking,
-- 
Petter Reinholdtsen