[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230623121412.25fbf45a.hanno@hboeck.de>
Date: Fri, 23 Jun 2023 12:14:12 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2023-31975: memory leak in yasm
On Tue, 20 Jun 2023 15:47:28 -0700
Alan Coopersmith <alan.coopersmith@...cle.com> wrote:
> https://nvd.nist.gov/vuln/detail/CVE-2023-31975 is freaking out
> scanners since it claims this bug has a CVSS of 9.8.
The problem really is that these scanners are assuming something that
is not true. They assume that data from vulnerability databases is
reliable.
These debates are coming on a regular basis, usually either "should
this thing get a CVE?" and "is this a reasonable CVSS value /
criticality rating?"
It's actually quite simple: There are dozends (maybe hundreds?) of CVEs
issued every day. If you want them to be properly vetted, you'd need to
have a massive team of security professionals doing that vetting. No
such team exists, so the only plausible assumption is that CVE and CVSS
data is by default unreliable.
If your scanner sounds an alarm because someone added a high CVSS
rating to a CVE entry, you should assume that the people creating that
scanner don't know what they are doing.
--
Hanno Böck
https://hboeck.de/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
