3 ms·
anyone can make a CVE and get it totally escalated out to be broadcast on all the CVE reporting sites for all eternity, and you as the maintainer of a project m
by zzzeek 3y ago
anyone can make a CVE and get it totally escalated out to be broadcast on all the CVE reporting sites for all eternity, and you as the maintainer of a project might never be notified at all. there's a whole community of people, somewhere, who just like to come up with really stupid CVEs and put them up. They get mirrored on hundreds of feeds / sites and there seems to be no vetting of any kind (I really don't know). Then the whole world thinks your project is insecure. I typically find these CVEs, well previously, by seeing them on Twitter. Even if these CVEs weren't friviolous, how is that the right way to go about reporting CVEs? it seems to be a pretty awful system.
- anamexis 3y agoYeah. As another example, the endless parade of ReDoS CVEs on every JavaScript library under the sun makes it hard to track real issues.
- fullspectrumdev 3y agoIt’s funny, it used to be impossible to get valid vulns assigned a CVE if the vendor wasn’t cooperating. And now it seems it’s possible to spam bogus CVE entries for mostly OSS projects, which devalues the use of CVE… while it’s also nearly impossible to get a valid CVE if a vendor who is a CNA stonewalls you.