3 ms·

> were you planning to patch the CRITICAL vulnerability but now that it's only HIGH you have dropped the patch? i mean it’s not far from the truth. do i wake u

> were you planning to patch the CRITICAL vulnerability but now that it's only HIGH you have dropped the patch? i mean it’s not far from the truth. do i wake up early on release day and rush out a manual patch, or do i do nothing and observe it to be fixed 1-2 days from now when my OS vendor ships an updated openssl in the course of business-as-usual? what kind of environment are you in where you’re keeping up with CVEs but don’t care about their categorization?

qwertox 4y ago
Their initial assessment was CRITICAL at the point of announcement. Turned out to be only HIGH. Aren't we lucky or what? Would I have preferred to not deal with it on this holiday? Yes. But I prefer to be safe than sorry, and the OpenSSL team is doing their best to help us be to safe. When was the last time you had to deal with such an issue, where a HIGH vuln was announced as a CRITICAL one?