oss-sec mailing list archives
Re: CVE-2022-21449 and version reporting
From: Seth Arnold <seth.arnold () canonical com>
Date: Thu, 28 Apr 2022 20:10:03 +0000
On Thu, Apr 28, 2022 at 02:12:04PM +0000, Seaman, Chad wrote:
In what universe exactly are versions omitted from vulnerability reporting because a vendor “no longer supports that version”… this non-supported version is still vulnerable?
A large part of software maintenance is managing technical debt -- and being able to walk away from no-longer-supported products is an important part of that. Would you expect Microsoft to evaluate Windows 3.11, Windows 95, Windows 98, Windows ME, Windows NT 3.51, Windows NT 4.0. Windows XP, etc for every single vulnerability discovered in newest products? Products that have reached end of life are clearly communicated as no longer supported; see, eg: https://endoflife.date/java There has been discussion about releasing "end of life" CVEs that indicate when a product goes out of support, so tooling built to compare lists of CVEs against software that's installed and in use at a site can report on it, but unless this is consistently applied across the entire ecosystem it is probably not useful enough for anyone to issue them. Of course, anyone asking for vulnerability information for EOL software can have a conversation with the sales team from their vendors. Probably every company has a price where they'd be happy to provide this information to you. Thanks
Attachment:
signature.asc
Description:
Current thread:
- CVE-2022-21449 and version reporting Seaman, Chad (Apr 28)
- Re: CVE-2022-21449 and version reporting Brian Behlendorf (Apr 28)
- Re: CVE-2022-21449 and version reporting Jeremy Stanley (Apr 28)
- Re: CVE-2022-21449 and version reporting Seth Arnold (Apr 28)
- Re: CVE-2022-21449 and version reporting Sven Schwedas (Apr 28)
- Re: CVE-2022-21449 and version reporting Seaman, Chad (Apr 28)
- Re: CVE-2022-21449 and version reporting Christian Fischer (Apr 30)
- Re: CVE-2022-21449 and version reporting John Helmert III (Apr 30)
- Re: CVE-2022-21449 and version reporting David A. Wheeler (Apr 30)
- Re: CVE-2022-21449 and version reporting Christian Fischer (Apr 30)
- Re: CVE-2022-21449 and version reporting John Helmert III (May 01)
- Re: CVE-2022-21449 and version reporting Christian Fischer (May 02)
- Re: CVE-2022-21449 and version reporting Sven Schwedas (Apr 28)
- Re: CVE-2022-21449 and version reporting Iron-Bound (Apr 29)
- Re: CVE-2022-21449 and version reporting Jeremy Stanley (Apr 30)