Compared with GitLab
GitLab is the comparison where our usual argument is weakest, because self-managed GitLab already runs on your own infrastructure. The difference is not hosting. It is what the product actually offers a vendor who needs to publish advisories about their own software.
Confidential issues and a curated database
GitLab's vulnerability handling is built on confidential issues: a report is filed privately in the project, worked on by maintainers, and eventually disclosed. Separately, GitLab maintains an advisory database of vulnerabilities in open-source dependencies, which feeds its dependency scanning.
GitLab is a CNA. The CVE Program lists its scope as the GitLab application itself, any project hosted in a public repository on GitLab.com, and vulnerabilities GitLab discovers that fall in no other CNA's scope.
Where it is genuinely stronger
It runs on your own hardware. Self-managed GitLab is a first-class deployment, so the argument that a hosted service means somebody else holds your unpublished vulnerabilities does not apply. If you already run GitLab, the confidential-issue workflow costs you nothing extra to adopt.
It is also where the work already is. The report, the discussion, the branch and the merge request are in one place, and no integration has to keep them in step.
Where it stops fitting
A confidential issue is a private conversation, not a published advisory. There is no advisory record with affected version ranges, severity, weaknesses, credits and references in a form a consumer can parse, no public advisory page for it on your domain, and no feed anybody can subscribe to. Closing the issue does not produce a document.
The CNA scope is the sharper limit and it is easy to miss. GitLab assigns for the GitLab application and for projects hosted in public repositories on GitLab.com. A company running self-managed GitLab and needing CVEs for their own shipped product is not inside that scope, so the CNA that comes with the tool is not the CNA for their product.
And the advisory database is GitLab's curation of other people's vulnerabilities, for their scanner. It is not a place a vendor publishes their own record.
What each is for
Keep the work in GitLab and the record in GAdvisory. The confidential issue is where the fix gets built; the advisory is the document you publish, cite and are asked about later, and it needs to outlive the issue tracker and be readable by people who have no account on it.
GAdvisory takes reports through its own intake as well, so a coordinated report does not have to start as an issue in a repository the reporter cannot see.
Related
The other comparisons, and what it takes to run this yourself.