Well that's a poor article. Not used to that from LWN at all. I think this sentence sums up most of its problems: > In fact, the pull request for the fix was a

Well that's a poor article. Not used to that from LWN at all. I think this sentence sums up most of its problems: > In fact, the pull request for the fix was attached to the report, but that apparently made little difference in the assessment from NVD. - CVEs are about vulnerabilities, not fixes. If everyone updated their software and all software updated its dependencies, I'm not sure we needed a vulnerability tracking system at all! The fix being available doesn't change the impact or exploitability of the bug while you run the out-of-date software - The text makes it sound like ratings given are opinions (elsewhere it talks about NVD having a "change of heart"). NVD uses a calculation system called CVSS where you input parameters like whether the vulnerable component can be reached over a network, whether the vulnerability results in denial of service or in confidentiality being breached or whatnot. These are objective parameters, and while interpretation mistakes are extremely common¹, ending up with a vastly different score is rather difficult if you have all relevant information to fill it out in the first place (also because mistakes are likely to cancel out). The article acts as though it's their subjective assessment, but rather, the score changes with new facts being presented. (In an ideal world, of course. In practice they typically forget or aren't told the correct info. But apparently here they were told and did update, so that's good right?) The article then goes on to state that curl uses its own subjective system now instead and they gave some bug an entirely different rating. The article does not say anything towards who had the more correct result but then goes with the assumption that curl's own subjective rating is better. Is that really what we want, when complaining that NVD gives bad ratings? More subjectivity, intransparency about how they got to a particular result? Anyway I'm neither loving the CVE system nor CVSS ratings either, but these are the wrong reasons ¹ http://export.arxiv.org/abs/2308.15259 http://export.arxiv.org/abs/2308.15259 recent study into CVSS scoring inconsistencies