Security Basics mailing list archives
What does it mean for a vulnerability to be retired?
From: Terra Frost <terrafrost () gmail com>
Date: Fri, 21 Dec 2007 12:11:26 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 <http://www.securityfocus.com/bid/26885> is an example of a vulnerability whose status has been changed to RETIRED. My question is.. what, exactly, does that mean? My guess is that it means that the vulnerability is bogus. But why, then, say it's RETIRED and not BOGUS? It's hard to misinterpret BOGUS, but rather easy to misinterpret RETIRED. Further, if that is indeed what RETIRED means, why would the above report, under "Vulnerable", say "WordPress", when, in fact, it isn't? Maybe, if anything, it should say WordPress and then have a strikethrough through it? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHbAHOhzLeabOflWcRAnJMAJoCmRiHYnmOLgjywLPn/RQHs4RWOwCdGreH wIJDT6A+rtFf/KXkg8Icsis= =Qtls -----END PGP SIGNATURE-----
Current thread:
- What does it mean for a vulnerability to be retired? Terra Frost (Dec 21)
- Re: What does it mean for a vulnerability to be retired? George A. Theall (Dec 21)
- Re: What does it mean for a vulnerability to be retired? Glenn Forbes Fleming Larratt (Dec 21)