2 ms·
Every month when there is a new Chrome release, there is a handful of CVSS 9.x vulnerabilities fixed. I'm always curious about the companies that require vendo
by semi-extrinsic 6mo ago
Every month when there is a new Chrome release, there is a handful of CVSS 9.x vulnerabilities fixed.
I'm always curious about the companies that require vendors to report all instances where patches to CVSS 9.x vulnerabilities are not applied to all endpoints within 24 hours. Are they just absolutely flooded with reports, or does nobody on the vendor side actually follow these rules to the letter?
- PunchyHamster 6mo agothe rating is nonsense anyway, which one actually applies to code you run varies wildly 9.x vulnerability might not matter if the function gets trusted data while 3.x one can screw you if it is in bad spot
- michaelt 6mo ago> I'm always curious about the companies that require vendors to report all instances where patches to CVSS 9.x vulnerabilities are not applied to all endpoints within 24 hours. That sounds like a nigh-impossible requirement, as you've written it. I suspect the actual requirement is much more limited in scope.
- UqWBcuFx6NV4r 6mo agoNo. It’s extremely common for security standards to be completely out of step with what’s actually viable in an organisation, and for aspects of them to be ignored, unspoken.
- L-four 6mo agoThe classic we need a 3 month approval process to update software but at the same time use SaaS that updates daily and breaks every other week.