4 ms·

Yet another case where the CVE system is absolutely broken. This has no reason to be a "medium" vulnerability, just like regular expression complexity DOS (redo

by junon 5y ago

Yet another case where the CVE system is absolutely broken. This has no reason to be a "medium" vulnerability, just like regular expression complexity DOS (redos) vulnerabilities have no business being classified as "high risk" in the majority of cases they're found. CVE scoring is antiquated and obsolete IMO. It means nothing to me anymore.

icegreentea2 5y ago
Do you think the scores in this case is too high or too low?
- junon 5y ago
  Too high. But it's not exactly about the score. The components of each rating don't make sense for how software is written these days. For example, since libraries aren't always used in networking contexts, but usually can be, CVE scores against them almost always include "network vector" as a means of exploitation, which immediately puts the score into the high 5 or 6 (medium high, if memory serves) - even if the library has nothing to do with networking. It makes little sense these days as opposed to back in the earlier days of the internet where many network-relayed applications were self contained and didn't use a lot of disparate libraries like we do today. Stuff like that - it's antiquated. It needs to be redone in my opinion.
remram 5y ago
I disagree. DOS should probably not be "high" but this has a non-imaginary arbitrary code execution. If this is not "medium", what would be a "medium" for Git? Any remote code execution should definitely be "high".
- junon 5y ago
  And by definition these days, almost every exploit is remotely exploitable under the right conditions. We put everything in front of a network gateway nowadays.
  - remram 5y ago
    A lot of them are remotely exploitable but most are information disclosures or DoS vectors, which don't always need to be "high". Remote code execution, definitely "high".
    - junon 5y ago
      A vulnerability that requires very specific, very uncommon setup is of course still a vulnerability, but not a high risk one. The setup described in this exploit is wildly uncommon - possible, but uncommon. That's more my point.

by junon 5y ago

icegreentea2 5y ago

Do you think the scores in this case is too high or too low?

junon 5y ago
Too high. But it's not exactly about the score. The components of each rating don't make sense for how software is written these days. For example, since libraries aren't always used in networking contexts, but usually can be, CVE scores against them almost always include "network vector" as a means of exploitation, which immediately puts the score into the high 5 or 6 (medium high, if memory serves) - even if the library has nothing to do with networking. It makes little sense these days as opposed to back in the earlier days of the internet where many network-relayed applications were self contained and didn't use a lot of disparate libraries like we do today. Stuff like that - it's antiquated. It needs to be redone in my opinion.

remram 5y ago

I disagree. DOS should probably not be "high" but this has a non-imaginary arbitrary code execution. If this is not "medium", what would be a "medium" for Git? Any remote code execution should definitely be "high".

junon 5y ago
And by definition these days, almost every exploit is remotely exploitable under the right conditions. We put everything in front of a network gateway nowadays.
- remram 5y ago
  A lot of them are remotely exploitable but most are information disclosures or DoS vectors, which don't always need to be "high". Remote code execution, definitely "high".
  - junon 5y ago
    A vulnerability that requires very specific, very uncommon setup is of course still a vulnerability, but not a high risk one. The setup described in this exploit is wildly uncommon - possible, but uncommon. That's more my point.