We would like to see that systemd upstream retrieves CVE's themself for their own bugs,
even if its believed that its just a local DoS.
This would make distributors life much easier when we read the git logs to spot potential issues.
The systemd git log is really huge, with lots of commits each week ("new services as a service").
Submission type
systemd version the issue has been seen with
Hello!
Don't know if systemd developers track the
seclists.org/oss-sec/site, but here is the idea of retrieving CVEs for systemd own bugs and logging them on to its git log. See: http://seclists.org/oss-sec/2017/q1/175 :Doable?