[semi-extrinsic]

Every month when there is a new Chrome release, there is a handful of CVSS 9.x vulnerabilities fixed.

I'm always curious about the companies that require vendors to report all instances where patches to CVSS 9.x vulnerabilities are not applied to all endpoints within 24 hours. Are they just absolutely flooded with reports, or does nobody on the vendor side actually follow these rules to the letter?

[L-four]

The classic we need a 3 month approval process to update software but at the same time use SaaS that updates daily and breaks every other week.

[michaelt]

> I'm always curious about the companies that require vendors to report all instances where patches to CVSS 9.x vulnerabilities are not applied to all endpoints within 24 hours.

That sounds like a nigh-impossible requirement, as you've written it.

I suspect the actual requirement is much more limited in scope.

[UqWBcuFx6NV4r]

No. It’s extremely common for security standards to be completely out of step with what’s actually viable in an organisation, and for aspects of them to be ignored, unspoken.

[PunchyHamster]

the rating is nonsense anyway, which one actually applies to code you run varies wildly

9.x vulnerability might not matter if the function gets trusted data while 3.x one can screw you if it is in bad spot