3 ms·

If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws

If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t. That would be worse in pretty much every respect. As it is now, I can look at a CVE and determine for myself and my organization whether it something we need to care about. I’d rather that decision stay in my hands, not someone else’s.

chgs 2y ago
So you are happy to have 1 million cves to look for per year per product? Unless there’s a minimum standard it becomes noise, and the real CVEs are lost.
- ziddoap 2y ago
  >So you are happy to have 1 million cves to look for per year per product? Trying to ignore the extreme hyperbole here... I want me or my team to see every security-related flaw affecting the products in our network, yes. That's literally our job. A CVE like this takes maybe 2 minutes for a junior on the team to mark as no risk.
  - tsumnia 2y ago
    I agree with ziddoap here. Not reviewing these minor bugs are exactly how we end up with sophisticated attacks using simple bugs that leave us arm chair experts commenting "How did they even think of this?!?!" Because the people that do conduct sophisticated attacks are studying every knock and cranny for these types of things. If they can find it once, they can automate it and find more. And then they move on to the next piece of their puzzle of "what can I do from here?"
  - 8338550bff96 2y ago
    That's a good way to get people to turn off security scanners
    - bravetraveler 2y ago
      Some reduction might not be so bad. I would love to know how many times I've said the phrase "the version string/CVE is irrelevant because our vendor backports patches" A lot of this can/should be boiled down to: are our updates and mirrors current? One selects an OS vendor/distribution explicitly to make this kind of thing their ~problem~ responsibility. They gave me "foo", they can fix it. There's usually no problem because nobody builds everything from upstream sources. The security vendor yells at me and the OS vendor about discoveries in something they never packaged. Each distribution gets sufficiently involved that I refuse to mind most CVEs. Eternally grateful my current role allows me to drop this charade
  - distortedsignal 2y ago
    I don't know that this CVE would be trivial to knock out. My CVSS score for this is as follows: CVSSv3.1:AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (I said "Low" integrity issues, and "Low" availability issues, since I don't know if the DOS issue is real) That reads out to a "Medium" CVE. I have, in the past, worked with some banks, and they want all 4+ CVSSv3 CVEs enumerated and either remediated or for a plan to be in place to remediate them. Maybe you're significantly better than I am at this, but I am hesitant to look at any CVE and say it's not a problem with how I have configured my software. Unless I have really deeply looked into the issue, I get really nervous saying a CVE is not going to affect my software.
  - suprjami 2y ago
    Except this isn't a CVE anyone will encounter in the workplace because nobody in their right mind would run Pi-Hole on a Raspberry Pi in a professional setting. It's a waste of time. If you want to dedicate staff to reviewing useless garbage issues you do that, go and review every issue logged against other non-commercial software. The rest of us have a job to do.
    - ziddoap 2y ago
      >The rest of us have a job to do. I'm not sure why you are being hostile about it, but okay. Obviously you feel very strongly about the subject. You should engage with MITRE and encourage them to reconsider their current CVE inclusion decision tree.
      - chgs 2y ago
        If Daniel Steinberg struggles to make headway with them…
    - Fnoord 2y ago
      Yeah except Bob, your uncle, is working from home and therefore needs to care about his home network security.
      - suprjami 2y ago
        I look forward to your explanation of how the temperature of Bob's Raspberry Pi poses a threat to his employer. I also wonder how the attacker got access to Bob's home network in the first place? If only he had the chance to focus on actual important security issues instead of constant notifications about useless noise like the temperature of his Pi-Hole.
        witrak 2y ago
        >I look forward to your explanation of how the temperature of Bob's Raspberry Pi poses a threat to his employer. Hmm, anything like this can be used as part of side channel if an attacker is able to influence the temperature of Bob's RPi.
shawnz 2y ago
> If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t. That's already the case now, since there's no perfectly objective way to decide whether a bug is even security related or not. This is just an example of where that already existing subjective distinction was applied in a way that not everyone agreed with. It's an unavoidable problem that is going to happen once in a while. It doesn't mean that CVEs are useless and it doesn't necessarily mean we need to be more liberal about what warrants a CVE either.
- ziddoap 2y ago
  >That's already the case now, since there's no perfectly objective way to decide whether a bug is even security related or not. Sure, you are right that a line already exists. However, that line basically boils down to "could this bug conceivably affect security". The decision tree is 4 questions long -- very simple. What I am opposed to is someone else answering "yes, this could conceivably affect security" and deciding on my behalf that I don't need to worry about it. That is a line for me (or someone who knows the organizations infrastructure, risk tolerance, etc.) to draw.
  - ploxiln 2y ago
    Except that in this case, the answer to that question is no, this could not conceivably affect security. It's the rough shape of something that could, but actually it could not. So we're back where we started. It's still subjective, how much you should "conceive the possibility", when it doesn't appear to actually be there.
    - deleted 2y ago
      [deleted]
jgalt212 2y ago
> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Yes, but one can envision a scenario where everything gets a CVE number and you, or members of your team, spend an inordinate amount of time looking up CVE numbers. Then along comes a service that you have to pay for that scores each CVE number for you. Due to any lack of discretion (in a database maintained by "experts"), you'll pay with your time, or your money.
- ziddoap 2y ago
  I'm quite happy with the current scenario and decision tree used to assign CVEs. As it stands right now, it is not "everything" that gets a CVE number. If they change the decision tree and spelling mistakes start being assigned CVEs, I am sure I will change my mind.
suprjami 2y ago
> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Except it doesn't work like this. A security scanner will include a CVE. People want no red flags on the security scanner. They don't care what the CVE is, they just want red mark go away. The attitude to accepting useless crap as a CVE is diluting what an important CVE actually is.
- ziddoap 2y ago
  >Except it doesn't work like this. You'll have to email my bosses that :)
- Fnoord 2y ago
  A decent security scanner allows you to exclude informational vulnerabilities. When I rolled out Wazuh in an org, it allowed for said function. And I still, personally, wanted to know about it at least once.
- Denote6737 2y ago
  If that is your attitude to security scanning, you should not be in charge of anything more important than a speak and spell.
  - DougN7 2y ago
    Seriously? Treating joke CVEs the same as true sev 1 issues is beyond silly and counter productive. There are very real limits to time, money and attention and pretending otherwise is foolish.
    - Citizen8396 2y ago
      The person you’re replying to seems to agree with you.
- Citizen8396 2y ago
  Are you speaking from your experience in vulnerability management? If anything, I’ve seen the opposite behavior (ignore everything except where the risk is critical). CVSS has been around since the mid-2000s, so it isn’t as if there’s no way to discern critical vulnerabilities from informational ones.
r3db34rd 2y ago
[dead]

chgs 2y ago

So you are happy to have 1 million cves to look for per year per product? Unless there’s a minimum standard it becomes noise, and the real CVEs are lost.

ziddoap 2y ago
>So you are happy to have 1 million cves to look for per year per product? Trying to ignore the extreme hyperbole here... I want me or my team to see every security-related flaw affecting the products in our network, yes. That's literally our job. A CVE like this takes maybe 2 minutes for a junior on the team to mark as no risk.
- tsumnia 2y ago
  I agree with ziddoap here. Not reviewing these minor bugs are exactly how we end up with sophisticated attacks using simple bugs that leave us arm chair experts commenting "How did they even think of this?!?!" Because the people that do conduct sophisticated attacks are studying every knock and cranny for these types of things. If they can find it once, they can automate it and find more. And then they move on to the next piece of their puzzle of "what can I do from here?"
- 8338550bff96 2y ago
  That's a good way to get people to turn off security scanners
  - bravetraveler 2y ago
    Some reduction might not be so bad. I would love to know how many times I've said the phrase "the version string/CVE is irrelevant because our vendor backports patches" A lot of this can/should be boiled down to: are our updates and mirrors current? One selects an OS vendor/distribution explicitly to make this kind of thing their ~problem~ responsibility. They gave me "foo", they can fix it. There's usually no problem because nobody builds everything from upstream sources. The security vendor yells at me and the OS vendor about discoveries in something they never packaged. Each distribution gets sufficiently involved that I refuse to mind most CVEs. Eternally grateful my current role allows me to drop this charade
- distortedsignal 2y ago
  I don't know that this CVE would be trivial to knock out. My CVSS score for this is as follows: CVSSv3.1:AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (I said "Low" integrity issues, and "Low" availability issues, since I don't know if the DOS issue is real) That reads out to a "Medium" CVE. I have, in the past, worked with some banks, and they want all 4+ CVSSv3 CVEs enumerated and either remediated or for a plan to be in place to remediate them. Maybe you're significantly better than I am at this, but I am hesitant to look at any CVE and say it's not a problem with how I have configured my software. Unless I have really deeply looked into the issue, I get really nervous saying a CVE is not going to affect my software.
- suprjami 2y ago
  Except this isn't a CVE anyone will encounter in the workplace because nobody in their right mind would run Pi-Hole on a Raspberry Pi in a professional setting. It's a waste of time. If you want to dedicate staff to reviewing useless garbage issues you do that, go and review every issue logged against other non-commercial software. The rest of us have a job to do.
  - ziddoap 2y ago
    >The rest of us have a job to do. I'm not sure why you are being hostile about it, but okay. Obviously you feel very strongly about the subject. You should engage with MITRE and encourage them to reconsider their current CVE inclusion decision tree.
    - chgs 2y ago
      If Daniel Steinberg struggles to make headway with them…
  - Fnoord 2y ago
    Yeah except Bob, your uncle, is working from home and therefore needs to care about his home network security.
    - suprjami 2y ago
      I look forward to your explanation of how the temperature of Bob's Raspberry Pi poses a threat to his employer. I also wonder how the attacker got access to Bob's home network in the first place? If only he had the chance to focus on actual important security issues instead of constant notifications about useless noise like the temperature of his Pi-Hole.
      - witrak 2y ago
        >I look forward to your explanation of how the temperature of Bob's Raspberry Pi poses a threat to his employer. Hmm, anything like this can be used as part of side channel if an attacker is able to influence the temperature of Bob's RPi.

shawnz 2y ago

> If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t. That's already the case now, since there's no perfectly objective way to decide whether a bug is even security related or not. This is just an example of where that already existing subjective distinction was applied in a way that not everyone agreed with. It's an unavoidable problem that is going to happen once in a while. It doesn't mean that CVEs are useless and it doesn't necessarily mean we need to be more liberal about what warrants a CVE either.

ziddoap 2y ago
>That's already the case now, since there's no perfectly objective way to decide whether a bug is even security related or not. Sure, you are right that a line already exists. However, that line basically boils down to "could this bug conceivably affect security". The decision tree is 4 questions long -- very simple. What I am opposed to is someone else answering "yes, this could conceivably affect security" and deciding on my behalf that I don't need to worry about it. That is a line for me (or someone who knows the organizations infrastructure, risk tolerance, etc.) to draw.
- ploxiln 2y ago
  Except that in this case, the answer to that question is no, this could not conceivably affect security. It's the rough shape of something that could, but actually it could not. So we're back where we started. It's still subjective, how much you should "conceive the possibility", when it doesn't appear to actually be there.
  - deleted 2y ago
    [deleted]

jgalt212 2y ago

> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Yes, but one can envision a scenario where everything gets a CVE number and you, or members of your team, spend an inordinate amount of time looking up CVE numbers. Then along comes a service that you have to pay for that scores each CVE number for you. Due to any lack of discretion (in a database maintained by "experts"), you'll pay with your time, or your money.

ziddoap 2y ago
I'm quite happy with the current scenario and decision tree used to assign CVEs. As it stands right now, it is not "everything" that gets a CVE number. If they change the decision tree and spelling mistakes start being assigned CVEs, I am sure I will change my mind.

suprjami 2y ago

> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Except it doesn't work like this. A security scanner will include a CVE. People want no red flags on the security scanner. They don't care what the CVE is, they just want red mark go away. The attitude to accepting useless crap as a CVE is diluting what an important CVE actually is.

ziddoap 2y ago
>Except it doesn't work like this. You'll have to email my bosses that :)
Fnoord 2y ago
A decent security scanner allows you to exclude informational vulnerabilities. When I rolled out Wazuh in an org, it allowed for said function. And I still, personally, wanted to know about it at least once.
Denote6737 2y ago
If that is your attitude to security scanning, you should not be in charge of anything more important than a speak and spell.
- DougN7 2y ago
  Seriously? Treating joke CVEs the same as true sev 1 issues is beyond silly and counter productive. There are very real limits to time, money and attention and pretending otherwise is foolish.
  - Citizen8396 2y ago
    The person you’re replying to seems to agree with you.
Citizen8396 2y ago
Are you speaking from your experience in vulnerability management? If anything, I’ve seen the opposite behavior (ignore everything except where the risk is critical). CVSS has been around since the mid-2000s, so it isn’t as if there’s no way to discern critical vulnerabilities from informational ones.

r3db34rd 2y ago

[dead]