Re: CVE-2022-21449 and version reporting

[Brian Behlendorf <brian () behlendorf com>]

On Thu, 28 Apr 2022, Seaman, Chad wrote:
> In what universe exactly are versions omitted from vulnerability 
> reporting because a vendor “no longer supports that version”… this 
> non-supported version is still vulnerable?

If that universe were consistent, it'd be one where vendors and open 
source projects issued pre-emptive CVEs when release branches are no 
longer provided with security fixes.

Brian