|
|
|
|
|
|
by romaniv
36 days ago
|
|
|
Nonsensical corporate posturing. "Microsoft will contribute expertise, resources, and AI technologies to help responsibly identify and fix vulnerabilities" As a reminder, Microsoft runs NPM and GitHub. Microsoft has access to the best AI models and massive data centers. Despite that, their own products are rapidly getting worse at security and their services are central hubs through which various exploits are propagated. They are not making things better, they are actively and rapidly making things worse. -- For a great example of how Microsoft deals with security issues within their own Open-Source projects, I recommend reading this GitHub thread: https://github.com/dotnet/efcore/issues/38257 EF core currently distributes a version of SQLite that has a severe vulnerability. The issue was discovered over a year ago. It was fixed by SQLite within one week. EF core didn't mark their driver as vulnerable until a user recently reported it, got bounced around and argued with developers. The current stable version of .NET core will only get a fix in roughly two months. |
|
|
Calling CVE-2025-70873 a severe vulnerability is a bit overplaying it imo. The vulnerability requires that you allow an attacker to import an arbitrary ZIP file
I looked at the vulnerability in question by the way, CVE-2025-70873, and it really is not that severe unless you're allowing users to import arbitrary ZIP files