Hacker News Reader

Comment by lucideer | Hacker News Reader

> > 2023-06-12: We learned that the embargo over this issue was violated by upstream via a GitHub PR [3]

To add further context, that PR violating the embargo:

- removes authentication entirely instead of fixing it

- discusses it as if they've discovered the CVE independently, even though it had seemingly been reported to them just 1 month prior. It may be that they did discover it independently, but the timing seems odd for a bug that existed for 3 years.

- discusses it in an extremely casual way, as if the vuln is not severe. Honestly I don't know enough about the vectors here to know what type of CVSS it might end up with.

---

Edit: Based on @AAchen's HN comment, it seems compromise requires local shell, so not an incredibly high severity it would seem. Still curious to see what NVD come out with.

View on HN

> Still curious to see what NVD come out with

9.8

It's always 9.8.

To be fair, this is an application, so the score might be more grounded in reality. The CVEs I encounter as a developer are always insane and generally massive overreach from security to product design. It's not a vulnerability against all downstream libraries and applications that using some obviously unsafe C++ call might cause a DoS due to poor performance.

NVD scores and bug classifications are completely useless, as they are often entirely misclassified. My favorite being that they slap the "network" attack vector on things which are not at all network related or exploitable.

CVSS is a poor metric because (by its own definition / admission) its got a very narrow intent: it doesn't really deal with exploitability in any meaningful way (like e.g. the shell access required here). There is a lot of ongoing discourse on its limitations, but its all in relatively early stages & imo its better to have something than nothing (especially when the maintainers of that "something" are aware of its limitations & actively working on better processes).

If you have 10 security bugs, 3 are genuinely high severity and 9 get assigned high severity by NVD, then at least you've managed to deprioritise one of them. It's something (unironiccally).

This is a pretty decent overview https://www.first.org/epss/model

Okay so almost useless, not entirely useless

A solid starting point for a very difficult problem

CVSS is really just used to stack-rank issues and decide how to handle them. Orgs get a list of CVEs, they sort them by score to decide which ones to handle first. From there someone removed from the actual process comes up with deadlines such as "All critical issues, defined as 9.0 or above, must be handled in 30 days." If they are reasonable there is additional language around "or best efforts must be made to resolve or mitigate the issue." If not, gghfdd.

On a side note, CVSS v4.0 arrived around 2023-01 and is.. maybe(?) better: https://www.first.org/cvss/v4-0/

Reply on news.ycombinator.com