The EEF CNA is covering specific projects like Erlang, Elixir etc. and all of the Hex.pm packages as a fallback.
Vulnerabilities in active packages hosted on Hex.pm, and in active projects hosted under the GitHub organizations @elixir-lang, @erlang, @erlef-cna, @erlef, @gleam-lang, @hexpm, @nerves-hub, @nerves-project, and @OpenRiak unless covered by the scope of another CNA.
The CVE Numbering Authority System is designed for decentralization. I welcome projects starting their own CNA. This is however quite a lot of work (bureaucracy, setting up all Report channels like OSV.dev, training participants etc.) So it only makes sense if you’re either a larger company that covers its Elixir Bindings or a large project in general. If anybody wants to do that, I’m happy to support that journey.
But most of our projects will not fit that model. And it also doesn’t make sense for a project with 2 maintainers to invest all that time in something that they hopefully only have to interact with very sparsely.
We included all Hex.pm packages in the scope (unless covered otherwise) to provide help to maintainers and to publish advisories with good metadata so that tooling can work well with it.
