4 ms·
Priority seem to be already downgraded to low, at least in Ubuntu: https://ubuntu.com/security/CVE-2020-19909 https://ubuntu.com/security/CVE-2020-19909 but i
by galkk 3y ago
Priority seem to be already downgraded to low, at least in Ubuntu:
https://ubuntu.com/security/CVE-2020-19909 https://ubuntu.com/security/CVE-2020-19909
but in the original site it's still critical
https://cve.report/CVE-2020-19909 https://cve.report/CVE-2020-19909
Hard to imagine how that could lead to any security compromise, the seemingly randomly assigned criticality is certainly unpleasant. Could it be that it was detected by "automated source code" and "website vulnerability" reports, when the tools very often assign HIGH, CRITICAL to random issues that aren't the problems
- tedunangst 3y agoAllegedly every report and score is reviewed by a human to determine accuracy.
- arp242 3y agoAllegedly some people are not very good at their alleged jobs. But even with the best people, mistakes do happen; sometimes as banal as clicking the wrong button or mixing up two tabs.
- tedunangst 3y agoThe curl project seems regrettably susceptible to mistabbing.
- RicoElectrico 3y agoThe pinch-hitter syndrome: https://statmodeling.stat.columbia.edu/2005/01/26/the_pinchhitter/ https://statmodeling.stat.columbia.edu/2005/01/26/the_pinchh...
- cratermoon 3y agoI'd say it's more like a manifestation of the neurology of humans: we are very bad at catching rare occurrences in stream of repeated events. Unless they somehow stand out from the rest, our brains aren't wired to notice them.
- dfox 3y agoEven if it is really reviewed it is reviewed by somebody who is part of the recent (5 years or so?) explosion of “cybersecurity” and thus incentived to overblow the issue.
- muldvarp 3y agoIt's reviewed by someone without any knowledge on the exploitable software. And even if it wouldn't take hours to even set up a testing environment, most CVEs don't include enough information to build an exploit anyway. No need to assume that the reviewers overblow these issues deliberately, there simply isn't anything to meaningfully review in most cases. They can filter out obviously meaningless bullshit, but that's about it. Source: Found a handfull of RCEs for popular PHP projects, some of which have CVEs.
- irrational 3y agoI had a QA coworker who got some online certification and was able to jump into a full remote cybersecurity role at our company with a large pay increase. I’ve worked with her for nearly a decade and while she is pretty good at QA I would never have really seen her as cybersecurity material. Now you say there has been an explosion in this area and I wondering if they are taking any warm body.
- fullspectrumdev 3y agoSome of the best people in security come from QA roles. Security roles largely are just adversarial QA.
- gmerc 3y agoElephant in the room is if this person was let go by ChatGPT … because if you ask chatGPT … it says this is serious - likely because of the word integer overflow in the description.
- cratermoon 3y agoYes, and there are cognitive and neurological reasons why that cannot work. "the story of AI being managed by a "human in the loop" is a fantasy, because humans are neurologically incapable of maintaining vigilance in watching for rare occurrences." https://pluralistic.net/2023/08/23/automation-blindness/#humans-in-the-loop https://pluralistic.net/2023/08/23/automation-blindness/#hum...
- rocqua 3y agoGiving the human some 'vigilance prompts' 25% of the time, with consequences for missing them, seems like an easy fix. Such prompts might be completely AI generated, or just flip the AI decision under review.
- cjbprime 3y ago> Hard to imagine how that could lead to any security compromise Integer overflows as a vulnerability class are often very bad, but usually when they're describing an attacker-controlled memory allocation size (which the attacker's buffer will then go on to overflow, often to byte-specific length accuracy). Sounds like the reviewer here could have been someone primed to think that "integer overflow" meant "integer overflow controlling a memory allocation", which doesn't seem to be the case here at all.