3 ms·
The CVE/CVSS system lacks ability to deal with soundness issues. If the language or a library promises to catch a mistake, and it doesn’t, that’s not automatic
by pornel 3y ago
The CVE/CVSS system lacks ability to deal with soundness issues.
If the language or a library promises to catch a mistake, and it doesn’t, that’s not automatically exploitable unless the programmer has actually made that mistake. If there wasn’t a promise in the first place, there would be nothing to report.
Unfortunately, CVE can’t see the difference between reporting a bug, or reporting a theoretical possibility of having a bug that never actually happened.
- mattgreenrocks 3y agoFrankly, I don't think industry is going to allow soundness issues to ever achieve parity of importance with what we think of as CVEs. There's simply too much code and mindshare around languages that don't worry as much about soundness. I'm not saying it is right, just that concerns around soundness will likely be hand-waved away. And it is to everyone's detriment.