This was discussed here: http://www.openwall.com/lists/oss-security/2017/07/02/1

> a rare example of a real problem that was assigned a CVE number by request of someone other than the developer

It's fairly common that the security researcher requests CVE. CVE request by an affected distro (which is what happened here) isn't anything unusual either.