3 ms·
Is anybody aware of a relative security ranking for the vulns / an indication of the maximum level of impact, similar to how OpenSSL grades their alerts before
by akerl_ 10y ago
Is anybody aware of a relative security ranking for the vulns / an indication of the maximum level of impact, similar to how OpenSSL grades their alerts before the release?
It's hard to tell for sure if curl is just bundling together several smaller vulns to save people doing 11 individual patch/update cycles, or if the implication is that one or more of the vulns are "critical".
- QUFB 10y agoThere's CVSS: https://en.wikipedia.org/wiki/CVSS https://en.wikipedia.org/wiki/CVSS The utility of such metrics is a topic of debate in the security community.
- akerl_ 10y agoMy apologies: I'm familiar with CVSS and other scales that exist, was more asking if a score is known for these particular disclosures so I can guesstimate how much of my other work I'll be sidelining to rush out the new fixed version.