5 ms·
Disclaimer: I had worked for Red Hat prodsec for 6 years doing the kernel work. It is common that I regularly resubmit rescores requests to CVSSv3 to NVD, the
by worthless-trash 3y ago
Disclaimer:
I had worked for Red Hat prodsec for 6 years doing the kernel work. It is common that I regularly resubmit rescores requests to CVSSv3 to NVD, they seem to be pretty good about it when it is clearly explained.
NVD will sometimes consider flaws scoring it the 'general' use case not in the specific use case which can make scoring libraries environment and usage specific.
- lars_francke 3y agoCan you - by any chance - talk about the tooling you used in that work (as in: the tech behind https://access.redhat.com/security/cve/cve-2023-34416 https://access.redhat.com/security/cve/cve-2023-34416 ). I assume it's all custom but we're looking for something just like it: https://news.ycombinator.com/item?id=36311682 https://news.ycombinator.com/item?id=36311682 If you're willing to you can find my contact details in my profile. Thanks!
- DannyBee 3y agoI am sure there are somewhat reasonable people on the other side. But it doesn't make it a sane process :) Making your own stuff up is not a solution for other people making stuff up or underselling things.
- worthless-trash 3y agoI have to agree, publishing your own scoring is not ideal however it is sometimes specific to the use case. This is one of the reasons why people are uncomfortable with CVSS, some scorers consider the general case, some scorers consider the actual used case.