4 ms·

I'm sure you know this but, for the benefit of others... With this exception, WireGuard does not CVEs because it is (for now) still considered pre-release soft

I'm sure you know this but, for the benefit of others... With this exception, WireGuard does not CVEs because it is (for now) still considered pre-release software and not recommended for production use.

kseifried 7y ago
CVE does cover "pre-release" software, part of the argument being you can't simply label something as "beta" and escape CVE coverage especially if millions of people are using it (Google's Chrome web browser was a good example of this). For example: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=prereleases https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=prereleases
- loeg 7y ago
  Sure, but Donenfield has specifically declared that CVEs not be issued for "pre-release" Wireguard components[1]: > Current snapshots are generally versioned "0.0.YYYYMMDD" or "0.0.V", but these should not be considered real releases and they may contain security quirks (which would not be eligible for CVEs, since this is pre-release snapshot software). [1]: https://www.wireguard.com/ https://www.wireguard.com/
  - kseifried 7y ago
    Yeah and he's not the boss of CVE. If someone wanted a CVE for wireguard I'd be happy to help them get one.
  - kseifried 7y ago
    Also to reiterate: "which would not be eligible for CVEs, since this is pre-release snapshot software" is not correct. It's usually correct, but not 100%.