3 ms·

Sometimes there's clearly no risk but an automated tool flags it anyway? Requiring a creative and meaningless "fix".

• danudey 3y ago
  Our product undergoes CVE scans before every release, and we ensure that all relevant CVEs are handled before we release; if a CVE is low-severity and isn't relevant to our use of the component (e.g. an information disclosure vulnerability in SASL authentication, but we don't use the library for authentication) then we make a note of that for our customers so they know that, while this CVE does exist and may show up in their own scans, it's not relevant to their use of our product. That said, we now have some customers who have extremely stringent security requirements, and for understandable reasons. They want every CVE resolved for every release; this is going to cause a notable amount of work to 'resolve' issues which aren't issues by taking developer time to update and test third-party libraries, or even patch the libraries ourselves if the upstream CVE hasn't been resolved yet. It's unquestionably worth doing if this is a dealbreaker for our customers, but could definitely impact things in the short term by requiring fixes which are technically unnecessary.