5 ms·

Generally speaking, anyone can file a CVE. Go file one yourself and force their response. This blogpost puts forth reasonably compelling evidence.

db48x 1y ago
Fun, but it doesn’t deserve a CVE. CVEs are for vulnerabilities that are common across multiple products from multiple sources. Think of a vulnerability in a shared library that is used in most Linux distributions, or is statically linked into multiple programs. Copilot doesn’t meet that criteria. Honestly, the worst thing about this story is that apparently the Copilot LLM is given the instructions to create audit log entries. That’s the worst design I could imagine! When they use an API to access a file or a url then the API should create the audit log. This is just engineering 101.
- gpm 1y ago
  Huh, there are CVEs for windows components all the time, random example: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... Including for end user applications, not libraries, another random example: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53784 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
- ecb_penguin 1y ago
  > CVEs are for vulnerabilities that are common across multiple products from multiple sources. This is absolutely not true. I have no idea where you came up with this. > Honestly, the worst thing about this story is that apparently the Copilot LLM is given the instructions to create audit log entries. That's not at all what the article says. > That’s the worst design I could imagine! Ok, well, that's not how they designed it. > This is just engineering 101. Where is the class for reading 101?
  - ThrowMeAway1618 1y ago
    >> CVEs are for vulnerabilities that are common across multiple products from multiple sources. >This is absolutely not true. I have no idea where you came up with this. Perhaps they asked Copilot?
- immibis 1y ago
  More accurately, CVEs are for vulnerabilities that may be present on many systems. Then, the CVE number is a reference point that helps you when discussing the vulnerability, like asking whether it's present on a particular system, or what percentage of systems are patched. This vulnerability was only present on one system, so it doesn't need a CVE number. It could have a Microsoft-assigned bug number, but it doesn't need a CVE.
  - fulafel 1y ago
    This may be a stated reason but it's questionable logic. There are of course many cases where people need to reference and discuss this vulnerability and its impact.
    - immibis 1y ago
      There are many cases where people need to reference and discuss the weather, but the weather doesn't need a CVE number. If you could hypothetically put it in a known vulnerability scanner then it should have a CVE. Otherwise no.
      - fulafel 1y ago
        It's for communication. "The Common Vulnerabilities and Exposures (CVE) Program’s primary purpose is to uniquely identify vulnerabilities and to associate specific versions of code bases (e.g., software and shared libraries) to those vulnerabilities. The use of CVEs ensures that two or more parties can confidently refer to a CVE identifier (ID) when discussing or sharing information about a unique vulnerability" (from https://nvd.nist.gov/vuln https://nvd.nist.gov/vuln)
  - HelloImSteven 1y ago
    But this isn't a problem on one system, it's potentially a problem in any system with Copilot enabled. It's akin to a vulnerability in a software library (which often means a separate CVE for every affected product, not just one for the library). CVEs also limited to issues impacting multiple systems; even if a vulnerability only affects one product, ideally a CVE should get made. The 'common' aspect is the shared reporting standard. See my other comment on this thread for more on that, or Redhat's explanation here: https://www.redhat.com/en/topics/security/what-is-cve https://www.redhat.com/en/topics/security/what-is-cve
- HelloImSteven 1y ago
  CVEs aren’t just for common dependencies. The “Common” part of the name is about having standardized reporting that over time helps reveal common issues occurring across multiple CVEs. Individually they’re just a way to catalog known vulnerabilities and indicate their severity to anyone impacted, whether that’s a hundred people or billions. There are high severity CVEs for individual niche IoT thermostats and light strips with obscure weaknesses. Technically, CVEs are meant to only affect one codebase, so a vulnerability in a shared library often means a separate CVE for each affected product. It’s only when there’s no way to use the library without being vulnerable that they’d generally make just one CVE covering all affected products. [1] Even ignoring all that, people are incorporating Copilot into their development process, which makes it a common dependency. [1]: https://www.redhat.com/en/topics/security/what-is-cve https://www.redhat.com/en/topics/security/what-is-cve
aspenmayer 1y ago
It’s true. The form is right here. When they support PGP, I suspect they know what they’re doing and why, and have probably been continuously doing so for longer than I have been alive. Just look at their sponsors and partners. https://cveform.mitre.org/ https://cveform.mitre.org/ Please only use this for legitimate submissions.
thombles 1y ago
Is there value in requesting a CVE for a service that only Microsoft runs? What's a user supposed to do with that?
- fulafel 1y ago
  CVEs are supposed to be unambigous references to vulnerabilities for communication, nothing more. So you can say stuff like "this happened was before CVE-XXXX was fixed, do we need to notify anyone about the risk of undetected insider info access?"
fulafel 1y ago
Not exactly. There are several CVE numbering authorities and some of them (including the original MITRE, national CERTs etc), accept submissions from anyone, but there's evaluation and screening. Since Microsoft is their own CNA, most of them probably wouldn't issue a MS CVE without some kind of exceptional reason.
- jayofdoom 1y ago
  Makes sense. I was wondering if that would be an issue. Thanks for the detail.

db48x 1y ago

Fun, but it doesn’t deserve a CVE. CVEs are for vulnerabilities that are common across multiple products from multiple sources. Think of a vulnerability in a shared library that is used in most Linux distributions, or is statically linked into multiple programs. Copilot doesn’t meet that criteria. Honestly, the worst thing about this story is that apparently the Copilot LLM is given the instructions to create audit log entries. That’s the worst design I could imagine! When they use an API to access a file or a url then the API should create the audit log. This is just engineering 101.

gpm 1y ago
Huh, there are CVEs for windows components all the time, random example: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... Including for end user applications, not libraries, another random example: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53784 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
ecb_penguin 1y ago
> CVEs are for vulnerabilities that are common across multiple products from multiple sources. This is absolutely not true. I have no idea where you came up with this. > Honestly, the worst thing about this story is that apparently the Copilot LLM is given the instructions to create audit log entries. That's not at all what the article says. > That’s the worst design I could imagine! Ok, well, that's not how they designed it. > This is just engineering 101. Where is the class for reading 101?
- ThrowMeAway1618 1y ago
  >> CVEs are for vulnerabilities that are common across multiple products from multiple sources. >This is absolutely not true. I have no idea where you came up with this. Perhaps they asked Copilot?
immibis 1y ago
More accurately, CVEs are for vulnerabilities that may be present on many systems. Then, the CVE number is a reference point that helps you when discussing the vulnerability, like asking whether it's present on a particular system, or what percentage of systems are patched. This vulnerability was only present on one system, so it doesn't need a CVE number. It could have a Microsoft-assigned bug number, but it doesn't need a CVE.
- fulafel 1y ago
  This may be a stated reason but it's questionable logic. There are of course many cases where people need to reference and discuss this vulnerability and its impact.
  - immibis 1y ago
    There are many cases where people need to reference and discuss the weather, but the weather doesn't need a CVE number. If you could hypothetically put it in a known vulnerability scanner then it should have a CVE. Otherwise no.
    - fulafel 1y ago
      It's for communication. "The Common Vulnerabilities and Exposures (CVE) Program’s primary purpose is to uniquely identify vulnerabilities and to associate specific versions of code bases (e.g., software and shared libraries) to those vulnerabilities. The use of CVEs ensures that two or more parties can confidently refer to a CVE identifier (ID) when discussing or sharing information about a unique vulnerability" (from https://nvd.nist.gov/vuln https://nvd.nist.gov/vuln)
- HelloImSteven 1y ago
  But this isn't a problem on one system, it's potentially a problem in any system with Copilot enabled. It's akin to a vulnerability in a software library (which often means a separate CVE for every affected product, not just one for the library). CVEs also limited to issues impacting multiple systems; even if a vulnerability only affects one product, ideally a CVE should get made. The 'common' aspect is the shared reporting standard. See my other comment on this thread for more on that, or Redhat's explanation here: https://www.redhat.com/en/topics/security/what-is-cve https://www.redhat.com/en/topics/security/what-is-cve
HelloImSteven 1y ago
CVEs aren’t just for common dependencies. The “Common” part of the name is about having standardized reporting that over time helps reveal common issues occurring across multiple CVEs. Individually they’re just a way to catalog known vulnerabilities and indicate their severity to anyone impacted, whether that’s a hundred people or billions. There are high severity CVEs for individual niche IoT thermostats and light strips with obscure weaknesses. Technically, CVEs are meant to only affect one codebase, so a vulnerability in a shared library often means a separate CVE for each affected product. It’s only when there’s no way to use the library without being vulnerable that they’d generally make just one CVE covering all affected products. [1] Even ignoring all that, people are incorporating Copilot into their development process, which makes it a common dependency. [1]: https://www.redhat.com/en/topics/security/what-is-cve https://www.redhat.com/en/topics/security/what-is-cve

aspenmayer 1y ago

It’s true. The form is right here. When they support PGP, I suspect they know what they’re doing and why, and have probably been continuously doing so for longer than I have been alive. Just look at their sponsors and partners. https://cveform.mitre.org/ https://cveform.mitre.org/ Please only use this for legitimate submissions.

thombles 1y ago

Is there value in requesting a CVE for a service that only Microsoft runs? What's a user supposed to do with that?

fulafel 1y ago
CVEs are supposed to be unambigous references to vulnerabilities for communication, nothing more. So you can say stuff like "this happened was before CVE-XXXX was fixed, do we need to notify anyone about the risk of undetected insider info access?"

fulafel 1y ago

Not exactly. There are several CVE numbering authorities and some of them (including the original MITRE, national CERTs etc), accept submissions from anyone, but there's evaluation and screening. Since Microsoft is their own CNA, most of them probably wouldn't issue a MS CVE without some kind of exceptional reason.

jayofdoom 1y ago
Makes sense. I was wondering if that would be an issue. Thanks for the detail.