4 ms·
Frankly, the end of the article where it says that CNAs don't have the time to verify the vulns being reported for new CVE issuance, is the real problem. If yo
by ang_cire 2y ago
Frankly, the end of the article where it says that CNAs don't have the time to verify the vulns being reported for new CVE issuance, is the real problem.
If you're an authoritative entity over a system (CVEs) that can break production systems (and to be clear, NIST recommends blocking builds/deploys that contain high CVEs), then it's also on you to make sure you're not issuing bogus CVEs.
- throwaway_62022 2y agoHa ha. The part that isn't being discussed how it is more profitable for certain commercial interests to have more vulnerabilities even if they are bogus. There is something wrong with security industry and we are all paying the price. At my day job some tool automatically opens security bugs against 15 or so repos we maintain and now we are on the hook for arguing how the report was bogus or fix the vulnerability. Just PR and Jira dance one has to do is exhausting.
- patrakov 2y agoThe recommendation of "blocking builds/deploys that contain high CVEs" is nonsense. It should be conditional on not having exactly the same CVE in what is already deployed, as it is blocking unrelated fixes.