Vulnogram is the record-authoring tool for CVE work. This fork adds attachment handling and CVSS vector pasting, the two places the workflow cost me the most time, plus a run of bug fixes. The upstream project and its licence belong to its author.
What it is
Vulnogram is the tool CNAs use to write CVE records. This is my fork of it, kept current with the parts of the workflow I actually run.
The upstream project belongs to its author and carries its own licence, which restricts use to CVE-related work. That licence is not mine to change and this fork does not try to.
Why fork it at all
Record authoring is where CNA work is either careful or it is not. Vulnogram is the best tool for it and it is also, like most tools built by the people who need them, shaped around one organisation's habits.
Forking was cheaper than arguing for every change upstream, and honest about the fact that some of these changes only make sense for how I work.
What I changed
Attachments, which is the largest piece. Upload handling, an attachment overview, a tab bar to reach it, and the configuration behind it. Advisory work generates artifacts: proofs of concept, patches, reporter correspondence. Keeping them in the same place as the record beats keeping them in a folder that means nothing to the next person.
CVSS pasting and editing. Pasting a vector string and having it parse into the editor, rather than re-entering a score somebody already computed. Re-keying a CVSS vector by hand is a transcription error waiting to happen, and the vector is the part that has to be right.
Beyond that, a run of bug fixes including one critical one.
Where it sits
47 commits on a codebase that goes back to 2017. This is a fork I maintain, not a project I started, and the entry says so.