[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <aQeYkP4vLYBFv2QQ@yuggoth.org>
Date: Sun, 2 Nov 2025 17:44:48 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: Questionable CVE's reported against dnsmasq
On 2025-11-02 02:26:31 +0100 (+0100), Solar Designer wrote:
[...]
>It is interesting that although Red Hat seems to dispute this CVE and
>doesn't intend to fix it, they nevertheless give it a non-zero CVSS
>score
[...]
While I find CVSS fairly useless for projects I work on (for the
same reasons Greg K-H eloquently explained in a recent post about
determining the "severity" of Linux Kernel vulnerabilities), we have
the concept of "vulnerabilities nobody's working on fixing" too.
Off-label or discouraged uses of software, or even seemingly
appropriate but not common uses, may lead to vulnerabilities which
the maintainers have not prioritized finding solutions to in their
limited available time. Maybe it's on the roadmap to solve
eventually, or merely the upshot of ancient design decisions that
can't be revisited due to conflicting backward compatibility
promises.
Point is, it's possible to acknowledge something's technically a
vulnerability, while having no plan to solve it in the immediate
future. Does that merit a CVE? I wouldn't personally request one for
it, but if a third party chose to assign one I wouldn't dispute it
either. If people refuse to use software containing "unfixed CVEs"
that's their choice.
--
Jeremy Stanley
Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
