3 ms·
> e.g., CVE-2005-2541 is considered a High severity vulnerability, but in Debian is considered “intended behavior,” making it a feature, not a bug. CVE-2005-25
by blueflow 2y ago
> e.g., CVE-2005-2541 is considered a High severity vulnerability, but in Debian is considered “intended behavior,” making it a feature, not a bug.
CVE-2005-2541 is documented & required behavior for the tar archive: https://marc.info/?l=bugtraq&m=112360016019030&w=2 https://marc.info/?l=bugtraq&m=112360016019030&w=2 . Infuriating that the CVE was seen as valid enough to get a number.