Synopsys Authorized as a CVE Numbering Authority (CNA)

Rhea-AI Summary

Synopsys has been officially designated as a CVE Numbering Authority (CNA) by the CVE Program, allowing its Software Integrity Group to assign CVE identifiers for newly discovered vulnerabilities. This status enhances Synopsys's ability to publish timely and accurate vulnerability information. The company aims to improve security within the open-source community through its Cybersecurity Research Center. This advancement positions Synopsys alongside notable companies like Google and Microsoft as a key player in application security, fostering transparency in vulnerability disclosure.

Positive

• Designated as a CVE Numbering Authority, enhancing credibility.
• Streamlined process for timely vulnerability information publication.
• Strengthened position in application security, supporting the open-source community.

Negative

• None.

MOUNTAIN VIEW, Calif., March 30, 2021 /PRNewswire/ -- Synopsys, Inc. (Nasdaq: SNPS) today announced the company's designation as a CVE Numbering Authority (CNA) by the CVE Program. As a CNA, the Synopsys Software Integrity Group is now authorized to assign CVE identification numbers to newly discovered vulnerabilities and publish information about the vulnerabilities in the associated CVE records.

Since the inception of its Cybersecurity Research Center (CyRC), Synopsys has strived to improve the security posture of the open source community through testing tools like Coverity Scan, by providing enriched CVE data to customers through Black Duck Security Advisories, and by responsibly disclosing vulnerabilities it discovers through the CVE Program and other CNAs. As a newly designated CNA, Synopsys can streamline the process of publishing accurate and timely vulnerability information it uncovers to the public.

"We're excited to take this next step in our progression as a good steward of the broader software ecosystem," said Jason Schmitt, general manager of the Synopsys Software Integrity Group. "As a leader in application security, vulnerability research is part of our DNA. As a CNA, we can more effectively and efficiently disseminate the results of our research to our customers and the software community in general—for both newly discovered vulnerabilities and existing CVE records that may be inaccurate or incomplete."

The CVE® Program is an international, community-based program whose mission is to identify, define, and catalogue publicly disclosed cybersecurity vulnerabilities. CVE IDs are assigned by CNAs, which are operated on a voluntary basis by participating organizations. Synopsys joins authorized commercial entities such as Linux, Red Hat, Google, and Microsoft as a CNA. 

"The identification and availability of accurate and timely vulnerability information is essential when protecting the software supply chain," said Christopher Fearon, Director of Research Engineering for the Synopsys Software Integrity Group. "As we expand our vulnerability research and development efforts within Synopsys CyRC, the direct nature of disclosing vulnerabilities as a CNA adds an increased level of transparency and speed to our research capabilities."

To disclose a vulnerability through Synopsys or to learn about our responsible disclosure process, visit our Responsible Disclosure Policy.

About the Synopsys Software Integrity Group

Synopsys Software Integrity Group helps development teams build secure, high-quality software, minimizing risks while maximizing speed and productivity. Synopsys, a recognized leader in application security, provides static analysis, software composition analysis, and dynamic analysis solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Synopsys helps organizations optimize security and quality in DevSecOps and throughout the software development life cycle. Learn more at www.synopsys.com/software.

About Synopsys 

Synopsys, Inc. (Nasdaq: SNPS) is the Silicon to Software™ partner for innovative companies developing the electronic products and software applications we rely on every day. As an S&P 500 company, Synopsys has a long history of being a global leader in electronic design automation (EDA) and semiconductor IP and offers the industry's broadest portfolio of application security testing tools and services. Whether you're a system-on-chip (SoC) designer creating advanced semiconductors, or a software developer writing more secure, high-quality code, Synopsys has the solutions needed to deliver innovative products. Learn more at www.synopsys.com.

Editorial Contact:

Liz Samet
Synopsys, Inc.
703-657-4218
esamet@synopsys.com 

View original content:http://www.prnewswire.com/news-releases/synopsys-authorized-as-a-cve-numbering-authority-cna-301258432.html

SOURCE Synopsys, Inc.

FAQ

What is the significance of Synopsys being designated as a CNA?

Being designated as a CVE Numbering Authority allows Synopsys to assign CVE identifiers, improving the transparency and speed of vulnerability disclosure.

How does Synopsys plan to use its CNA status?

Synopsys intends to enhance its vulnerability research and efficiently disseminate information about newly discovered vulnerabilities.

Which notable companies are also CNAs alongside Synopsys?

Notable companies include Linux, Red Hat, Google, and Microsoft.

What is the goal of the CVE Program?

The CVE Program aims to identify and catalog publicly disclosed cybersecurity vulnerabilities.

When was Synopsys designated as a CNA?

Synopsys was designated as a CVE Numbering Authority on March 30, 2021.