[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20220428201003.GA1260523@millbarge>
Date: Thu, 28 Apr 2022 20:10:03 +0000
From: Seth Arnold <seth.arnold@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2022-21449 and version reporting
On Thu, Apr 28, 2022 at 02:12:04PM +0000, Seaman, Chad wrote:
> In what universe exactly are versions omitted from vulnerability
> reporting because a vendor “no longer supports that version”… this
> non-supported version is still vulnerable?
A large part of software maintenance is managing technical debt --
and being able to walk away from no-longer-supported products is an
important part of that.
Would you expect Microsoft to evaluate Windows 3.11, Windows 95,
Windows 98, Windows ME, Windows NT 3.51, Windows NT 4.0. Windows XP,
etc for every single vulnerability discovered in newest products?
Products that have reached end of life are clearly communicated as no
longer supported; see, eg:
https://endoflife.date/java
There has been discussion about releasing "end of life" CVEs that indicate
when a product goes out of support, so tooling built to compare lists of
CVEs against software that's installed and in use at a site can report on
it, but unless this is consistently applied across the entire ecosystem it
is probably not useful enough for anyone to issue them.
Of course, anyone asking for vulnerability information for EOL software
can have a conversation with the sales team from their vendors. Probably
every company has a price where they'd be happy to provide this
information to you.
Thanks
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
