Skip to main content

CVE-2023-27536

Announced by the #curl project back in March 2023. We deem it severity Low. curl.se/docs/CVE-2023-27536.ht…

NVD, in their infinite wisdom, thinks this is a CRITICAL 9.8 flaw: nvd.nist.gov/vuln/detail/CVE-2…

I wish I knew how to fix this annoying problem but talking or whining to NVD certainly does not seem to help.

curl - GSS delegation too eager connection re-use - CVE-2023-27536

curl.se
#curl
in reply to daniel:// stenberg://

daniel:// stenberg://
daniel:// stenberg://
• •

After my complaint the NVD has "downgraded" it to a 7.5 (high).

My response: you are scaremongering. It is not a high either.

This entry was edited (1 year ago)
in reply to daniel:// stenberg://

Gregory P. Smith (he/him) 🚲🦝
Gregory P. Smith (he/him) 🚲🦝
• •

100% agreed that the CVSS scoring system and "assume the worst" guidance makes for scores that do not accurately reflect importance. Especially for very broad-use things.

My take on this is that. like it or not, more open source projects of note need to become "CNA" (certificate numbering authorities) of their own which I understand can given them some control over the content of CVEs filed against their project. cve.org/ProgramOrganization/CN…

#cve #cvss #cna #oss

cve-website

www.cve.org
#oss #cve #cvss #CNA
in reply to daniel:// stenberg://

Joel
Joel
• •
I feel your frustration. I've been dragged into the CVE mess recently for Linux kernel issues. So many low quality reports, and incorrect conclusions about exploitability. It's a huge time sink for orgs that are told they must act on every CVE.
⇧