On 2025-11-02 02:26:31 +0100 (+0100), Solar Designer wrote: [...]
It is interesting that although Red Hat seems to dispute this CVE and doesn't intend to fix it, they nevertheless give it a non-zero CVSS score
[...]
While I find CVSS fairly useless for projects I work on (for the same reasons Greg K-H eloquently explained in a recent post about determining the "severity" of Linux Kernel vulnerabilities), we have the concept of "vulnerabilities nobody's working on fixing" too. Off-label or discouraged uses of software, or even seemingly appropriate but not common uses, may lead to vulnerabilities which the maintainers have not prioritized finding solutions to in their limited available time. Maybe it's on the roadmap to solve eventually, or merely the upshot of ancient design decisions that can't be revisited due to conflicting backward compatibility promises.
Point is, it's possible to acknowledge something's technically a vulnerability, while having no plan to solve it in the immediate future. Does that merit a CVE? I wouldn't personally request one for it, but if a third party chose to assign one I wouldn't dispute it either. If people refuse to use software containing "unfixed CVEs" that's their choice.
-- Jeremy Stanley
signature.asc
Description: PGP signature
