Problem with CVEs on OSS Projects

Probably best to link to specific comment: https://github.com/micromatch/micromatch/issues/264#issuecom...

From issue:

    * Checkmarkx (security vendor) reported bogus cve in april / may
    * Maintainers didn't agree the cve was real so they ignored it
    * Snyk and other automated scanners start harassing users about the cve
    * Users are annoyed by scanners and scary messages from all kinds of tools
    * Users start messaging devs, also devs of dependent packages which use micromatch
    * Hundreds, maybe thousands of hours are wasted


    In the end, the situation erodes trust into automated scanners. This is "a boy who've cried wolf" type of situation. When useless vulnerabilities get promoted, it's easy to lose track of something more important.


    Besides automated scanners, checkmarx should also be held responsible for this waste of everyone's time.

That's why I had to a special Invalid CVE tag to some issues:

https://github.com/LibreDWG/libredwg/issues?q=is%3Aissue+lab...

Reporters barely can read nowadays and CVE centers neither.

Articulate post on the problems with bogus CVEs