Will DormannMay 8, 2024
As if the Broadcom VMware acquisition wasn't cringeworthy enough...
VMware Security Advisories (VMSAs) are now to be non-public.
You'll need a support portal account to even know that they exist.
https://blogs.vmware.com/security/2024/05/where-did-my-vmware-security-advisories-go.html
Show threadCarlos O'DonellMay 8, 2024
@wdormann VMWare is a CNA in the MITRE CNA program and the CNA v4.0 rules require one public reference for CVEs e.g. "5.1.10 MUST contain at least one public reference (see 5.3)." and "5.3.3.1 SHOULD NOT require registration or login, and" ... guess it's not a "MUST NOT" :/
Show threadschrotthaufenMay 9, 2024
@codonell @wdormann It’s a pity they used “should not” for that. “[…] the full implications should be understood and the case carefully weighed before implementing any behavior described with this label.” I guess they didn’t think about the implications hard enough.
Show threadCarlos O'DonellMay 9, 2024
@schrotthaufen @wdormann @msw Matt, Any idea why we used "SHOULD NOT" here for the public reference portion? In the interest of cybersecurity and entire ecosystem I would like to have seen 5.3.3.1 be "MUST NOT"
Show threadWill Dormann
@codonell @schrotthaufen @msw
Per CVE rules, it's perfectly fine for a CVE reference to require a login.
As long as you don't have to be a paying customer or have other restrictions.
May 9, 2024 at 12:57pmWeb