Re: Thoughts on a vuln/CVE?

[Florian Weimer <fw () deneb enyo de>]

* Kurt Seifried:

> I care a lot less about what is "officially endorsed" or not endorsed
> and a lot more with what is actually going on. If a large percentage
> of people are exposed to a vuln, even if they "shouldn't" be then it
> would still get a CVE. I see a lot of CVEs that should never be
> exploitable, but people do crazy things/configurations.

But the present situation is really not that clear-cut.  We have no
indicator of malicious intent from the current domain owner, and users
would still have to disable signature checking *and* they must have
configured the problematic repository.  That's a little bit
far-fetched.