3 ms·
In this particular case they probably should have reported it as a regular bug and not as a vulnerability, but I am not sure this generalizes to CVE numbers bei
by omoikane 2y ago
In this particular case they probably should have reported it as a regular bug and not as a vulnerability, but I am not sure this generalizes to CVE numbers being meaningless since I am not sure how often it happens.
- jeroenhd 2y agoMost CVE numbers are useful, but there are enough meaningless ones that will set off commercial security scanners to extort a sale to make them unreliable enough that you need to dig into most of them (rather than just assume they're security risks and treat them with the correct priority). Annoyingly, there are also plenty of security bugs that don't make it through the CVE system. In a perfect world, you should be able to treat a CVE number in a scan or bug report as something of importance, but in practice you need to filter out the "time protocol allows reading the time" class of CVEs as well. CVEs might as well be links to Github issues if they're treated like this.