3 ms·
> CVEs are given to fixes deployed in security releases when customers need to take action to stay protected. In this case, the mitigation will be automatically
by fulafel 1y ago
> CVEs are given to fixes deployed in security releases when customers need to take action to stay protected. In this case, the mitigation will be automatically pushed to Copilot, where users do not need to manually update the product and a CVE will not be assigned.
Is this a feature of CVE or of Microsoft's way of using CVE? It would seem this vulnerability would still benefit from having a common ID to be refrenced in various contexts (eg vulnerability research). Maybe there needs to be another numbering system that will enumerate these kinds of cases and doesn't depend on the vendor.
- deleted 1y ago[deleted]
- eleveriven 1y agoYeah, this feels more like Microsoft bending the CVE process to fit their PR needs than a limitation of CVEs themselves
- dathinab 1y agoMicrosoft CVE track security incidents/vulnerabilities just because you can emergency patch it out of band does not make it not an incident but it falls under a trend of Microsoft acting increasingly negligent/non trusteable when it comes to security, especially when it comes to clear reporting about incidents. Which when it comes to a provider of fundamental components like an OS or Claude is as important as getting security right.
- immibis 1y agoIt's a feature of CVE. The C stands for Common.
- kuschku 1y agoI'd argue it'd still make sense to assign a CVE here. While you don't need to coordinate patching, many companies will need to issue reports to hipaa/gdpr oversight agencies, customers, employees, etc and having a common id for this vulnerability would make it easier to reference it and any related information.