What do you select as remediation level if only a Git commit is available?

A very common scenario for this are vulnerabilities in the Linux kernel, before a fix becomes part of the stable branch it's only available as a commit.

Options are:

  • Not Defined (X)
  • Unavailable (U)
  • Workaround (W)
  • Temporary Fix (T)
  • Official Fix (O)

We often go with Temporary Fix, which might make sense for the Linux kernel, but what about "normal" Open Source projects, where using the Git repo is not as common as using the Linux kernel repo. Therefore customers won't pull this commit.

What do you think? The official documentary isn't clear at this point.

1 Answer 1


The remediation level is a property of the vulnerability: is it fixed or not?

Let's translate each level to CVE-2016-3714 to see a concrete example:

  • Unavailable: there's no fix or mitigation available. Most bugs start in this level
  • Workaround: the developers have yet to pitch in, but you can mitigate the risk by checking the magic number of uploaded images and only allowing whitelisted formats
  • Temporary fix: the developers are working on a patch, meanwhile they recommend to add this policy to your policy.xml file.
  • Official fix: an official patch has been released, you should upgrade your install.

The question thus becomes "At what point is a patch considered released?"

This will vary for each project: for some it's when the fix hits their "trunk" branch, for others it's when the update hits the auto-updater, for a distro it's when it hits the official repositories.

It's something that has to be defined by the project and is beyond CVSS' scope.

If you don't know how you should define it, think how your users got hold of your software in the first place and consider anything released through that same channel as released.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .