Hacker News new | ask | show | jobs
by rfd4sgmk8u 1637 days ago
Hang about. You may have misunderstood what CVE is. CVE doesn't mean 'world ending vulnerability'. It means "common vulnerability and exposure".

It is merely a way of tagging security vulnerabilities through multiple products. Before CVE it was difficult to reason if a product was insecure because it had a an insecure component. CVE speaks to nothing of the severity (that CVSS), just that two products that have the same CVE suffer from the same root vulnerability in their components.
2 comments
mnd999 1637 days ago
Whether I misunderstand it or not (I don’t) is irrelevant because customers run scanning tools and demand fixes for any CVE without attempting to understand them.
link
rfd4sgmk8u 1637 days ago
So, you either explain to the customer about how the CVE is out of scope in this context due to the various mitigations or lack of exploitability, or you patch it. Every CVE is real, and should be addressed. Your customers pay you to help them understand it.
link
Sebguer 1637 days ago
That's fair, but it's not really the fault of MITRE / the CVE database, it's the fact that people have been incentivized to submit these. Similar conversations have come up around how NPM handles vulnerability reports, since they treat all vulnerabilities the same, including very low-risk ones like DoS risks that require control of your build pipeline.

The problem is compounded in cases like Log4j where not even the CVE score can be trusted, or in cases you're describing where end-users don't understand CVE itself and only know it in the context of these 'world-ending' vulnerabilities.

link
rfd4sgmk8u 1637 days ago
The CVSS score cannot be trusted? How so? I don't see why any of the log4j CVE's 'cant be trusted'?
link
Sebguer 1637 days ago
The third CVE arbitrarily had a score of ~7.5 despite requiring a non-standard configuration and only enabling a denial of service attack. The preceding CVE with the same outcome only warranted a 3.5, until it was shown to also potentially allow an RCE. CVSS is honestly pretty open to interpretation, since it's not a particularly objective set of measures.
link
rfd4sgmk8u 1637 days ago
Fair enough, I agree with you there. CVSS(v2/v3) can be subjective and can change when new information comes to light.
link
Quekid5 1637 days ago
This one is pretty milquetoast. Clickbait-y title to it, even.
link