When conducting penetration testing in a PCI-DSS compliance context, we found a known security vulnerability that's identified by a CVE number.
In this case, the finding in question is CVE-2016-20012, which is marked on the CVE database as **DISPUTED**.
There are many CVEs like this. The vendor does not want to acknowledge this as a valid vulnerability vector, and all distributions containing the affected software have marked this vector as "WILL NOT FIX" in their repositories, so there aren't even patches to apply for it.
While I as a pentester understand the vendor's reasons for wanting to dispute this CVE, the fact remains that it's still a known CVE, and has a CVSS Base score of 5.3, which is above the 4.0 score that PCI-DSS says needs to be mitigated in order to comply with their standards.
What is the best practice approach in situations like this? Can we ignore this finding? What is the justification for accepting this finding not getting fixed in a PCI-DSS context?
I couldn't find any conclusive answer on this matter anywhere on the internet.
REFERENCES:
https://ubuntu.com/security/CVE-2016-20012