How do the CRA reporting obligations for open source software stewards apply to vulnerabilities in obsolete versions?

[mbarbero]

I have not found clear guidance on whether an open source software steward’s reporting obligations are limited by anything comparable to a product’s “support period.”

Suppose a steward becomes aware of an actively exploited vulnerability affecting version 2.1.0 of an open source project, released in 2008. The project itself remains actively maintained, and the current release is version 9.4.3, but version 2.1.0 has not been maintained or supported for many years.

Would the steward still have an obligation under the Cyber Resilience Act to report the actively exploited vulnerability?

Section 9.1, paragraph 211 of the latest guidance states that, for manufacturers, reporting obligations continue even after a product is no longer supported:

Unlike the obligation to comply with vulnerability handling obligations, which continues for the duration of the product’s support period, reporting obligations continue to apply also after a product is no longer supported.

However, this passage appears to address manufacturers rather than open source software stewards.

More broadly, how should a steward determine which historical versions remain within the scope of its reporting obligations? For example, version 2.1.0 from 2008 is clearly no longer maintained, but an earlier release such as version 9.3.1, issued five months ago, may also no longer receive updates once superseded.

Where does the CRA draw the line between versions for which a steward must report an actively exploited vulnerability and versions that are sufficiently obsolete to fall outside the reporting obligation?

Are stewards expected to report actively exploited vulnerabilities on the same basis as manufacturers—meaning that the reporting obligation continues indefinitely, including for versions that have been unsupported for many years?

[mbarbero]

My preference would be to leave it up to each project to decide which versions it supports and maintains, with only those versions falling under the reporting obligations. We will certainly also need to define a way to declare end of life for some versions, and ECMA-428 appears well suited for this purpose: https://ecma-international.org/publications-and-standards/standards/ecma-428/

[tobie]

As mentioned in chat, my hunch is that once a version reaches end of life, it is no longer aimed at commercial use and hence by definition is no longer stewarded. I believe this fits how the community understands EOL. As I’ve said elsewhere I suggest that the FAQ’s role is not only to seek answers to questions in legal documents but also to shape the doctrine by surfacing community understanding and practices. This seems to be one of those cases where the answer is for us to shape given what’s reasonable and expected.

[rozhukov]

I generally concur with Tobie's opinion, it sounds reasonable to me. Even for manufactures for the products that are "no longer supposed to be on the market" and past all required support phases, it'd be hard to do and to enforce continuous reporting, I guess.

For FOSS - once the particular version of the project is EOL'ed (I agree the good practice would be to clearly document it, e.g. following OASIS OpenEoX or ECMA-428 CLE), that particular version is not expected to be used in prod/commercial. Even if the newer version is maintained, the old version is unlikely to be considered in scope. One can argue that "ok, as a user I still use this old version in prod and wanna continue to do so by paying for extended support to someone who can do it". There will be one tricky part about it, because the EU COM is saying entities that provide paid security updates (meaning monetize part of the CRA essential reqs) can be qualified as manufacturers, even though they're not original authors.

[tobie]

There will be one tricky part about it, because the EU COM is saying entities that provide paid security updates (meaning monetize part of the CRA essential reqs) can be qualified as manufacturers, even though they're not original authors.

Oh absolutely; that makes total sense.