What do you select as remediation level if only a Git commit is available?
A very common scenario for this are vulnerabilities in the Linux kernel, before a fix becomes part of the stable branch it's only available as a commit.
- Not Defined (X)
- Unavailable (U)
- Workaround (W)
- Temporary Fix (T)
- Official Fix (O)
We often go with Temporary Fix, which might make sense for the Linux kernel, but what about "normal" Open Source projects, where using the Git repo is not as common as using the Linux kernel repo. Therefore customers won't pull this commit.
What do you think? The official documentary isn't clear at this point.