4 ms·
A CVE is just a common identifier, like a bug number when you file a bug report. Just because you can file a bug in most projects doesn't mean these bug numbers
by rlpb 3y ago
A CVE is just a common identifier, like a bug number when you file a bug report. Just because you can file a bug in most projects doesn't mean these bug numbers present valid bugs, and the same applies to CVEs. Some in the industry tend to assume that every CVE is valid without considering it for themselves. That's where the problem begins.
- mordae 3y agoIt is already spilling outside the industry.
- TheDong 3y agoThis analogy is flawed. Bug reports are opened and then, after they get a number, are triaged. CVE numbers are applied for, and then separately they are granted only sometimes. A CVE number being granted means that an organization, a relevant CNA[0] for the project in question, has confirmed that they think it is a real security issue. MITRE says CVE IDs indicate a real vulnerability, not "reports that have not been triaged yet", so clearly it's intended that they're mostly valid. It is true that you have to think critically about CVEs, obviously, but I don't think it's helpful to excuse MITRE for this by saying "no, actually, the numbers were never meant to mean anything", when they themselves have never held that stance. [0]: https://www.cve.org/ProgramOrganization/CNAs https://www.cve.org/ProgramOrganization/CNAs
- rlpb 3y ago> confirmed that they think it is a real security issue There is no definition or even industry consensus of what is a real security issue. Scoring systems are widely accepted as flawed. So in practice, this isn't how it works, as the article demonstrates.