Oh fantastic. Someone assigned a CVE to an invalid bug report. Of course it's rated "critical".
Now I have to file for a rejection again, while thousands of "vulnerability report sites" copy each others bad summary of the CVE text making it worse with every copy.
The whole CVE system and the "security research industry" at large is a steaming pile of 💩
@dokuwiki recently had to assess the impact of two CVEs in bouncy castle on our Software. All I could find description wise was "denial of service"
Not kidding.
Score was 7.5
What are customers expecting me to say? "Yeah, we ship the affected version, no we're not sure what this means, if you can't take that risk, find a competitor that doesn't use the most widely used security library in the world" 🤷
@DJGummikuh @dokuwiki oh, those bouncy castle ones are interesting if you actually research them. It's basically "This might happen if very specific circumstances occur and you're using a specific JVM."
IIRC Mitigation was "We don't touch this part of the BC library and don't use that version of Java."
How about a "critical" SQLi vulnerability in something that was deprecated in 2014? Reported by the same user... 🤦♂️
https://github.com/Hebing123/cve/issues/16#issuecomment-1893148729
https://github.com/advisories/GHSA-jqqj-j2ch-3qv8
DokuWiki
Zeki Çatav 🤔 ☕ 🕯️🎶
DJGummikuh
Alanna 🏳️🌈🏳️⚧️
Aatch
Andreas
Jeremy List
⬡-49016 (moved to catgirl.cloud!)