3 ms·
Do you have a source for it?
by telmich 7y ago
Do you have a source for it?
- PlutoIsAPlanet 7y agoSure https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm... https://www.cvedetails.com/product/38088/Freedesktop-Systemd.html?vendor_id=7971 https://www.cvedetails.com/product/38088/Freedesktop-Systemd... For a piece of software used by millions of machines, that's a very low CVE count.
- markstos 7y agoIn 2017, the Linux Kernel had over 450 CVEs, while systemd had 5. https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm... https://www.cvedetails.com/vulnerability-list/vendor_id-7971/product_id-38088/Freedesktop-Systemd.html https://www.cvedetails.com/vulnerability-list/vendor_id-7971... So far in 2019, the gap has narrowed: "only" 45 CVEs so far for the Linux kernel, and 7 for systemd.
- snazz 7y agoAs marcosdumay said upthread, “Systemd has a historic of refusing to fill CVEs, even for incredibly bad vulnerabilities.” This contributes to the low rate of CVEs in systemd relative to Linux (for which many less-important bugs get CVEs).
- the_why_of_y 7y agoA quick look at the list of CVEs in the grandparent comment indicates that there are at least 3 different Assigning CNAs for systemd CVEs: MITRE Corporation, Red Hat, Inc. and Canonical Ltd. My conclusion is that the systemd project is not its own CNA and therefore not in a position to authoritatively decide which systemd bugs get CVE numbers assigned and which do not.