67
votes
Accepted
Are CVE counts a good indicator of a software's security?
Can we say that a software is "more secure" than another, based on the number of CVEs these softwares have?
No. CVE entries are not a good source to rank products by their "overall security".
The ...
- 43.7k
66
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier ...
- 132k
43
votes
How useful are CVE entries?
They're useful, they're just not useful for building exploits. They're not useful for determining how buggy a software is for that matter either...The number of CVEs has no strong correlation with ...
- 35.5k
25
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of ...
- 31.8k
22
votes
How useful are CVE entries?
The main use case for CVE is to have unique identifiers for software vulnerabilities. It is not a good tool to measure a product's overall security and won't help you with the in-depth analysis of a ...
- 43.7k
16
votes
Accepted
What to do after you get a CVE?
Given you have referenced Github, I will assume this related to some type of As an open source project, a note to oss-sec is a good idea. This will bring it to the attention of most upstream ...
- 7,917
15
votes
Accepted
Would CVE-2016-0728 affect Docker?
This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between ...
- 181k
15
votes
Accepted
How to read CVE - 2016 - 5696 correctly
Does the version next to pending refer to kernel version for which the fix is released?
Yes- more precisely, the version next to "pending" refers to the version of the package within the ...
- 3,329
14
votes
Accepted
Why is the code CVE-2010-5298 used for a vulnerability discovered in 2014?
It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after ...
- 4,608
14
votes
Why do some known vulnerabilities have no CVE ID?
Why don't some vulnerabilities have CVE numbers?
It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) ...
- 43.7k
13
votes
How useful are CVE entries?
CVEs are useful in several ways.
First, and perhaps most importantly, they provide a common term for a particular vulnerability. This makes it easy to ensure that when someone says "did you see that ...
- 9,383
11
votes
Accepted
What is the reason for the increase of CVEs since 2017?
Until 2016, MITRE was having trouble assigning CVEs. The process was cumbersome, it took a very long time, and more often than not, researchers simply didn't get a CVE assigned.
In 2017, MITRE ...
- 29k
9
votes
Accepted
Should CVE be assigned to an application even if the vulnerability is in a vulnerable 3rd-party library?
From the CVE Numbering Authority (CNA) Rules:
2.1.2
2.1.2 If a CVE ID is being assigned to a vulnerability, the CNA MUST make a reasonable effort to notify the maintainer of the code in which that ...
- 13.9k
8
votes
Difference between hardening guides (CIS, NSA, DISA)
In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission ...
- 81
8
votes
Accepted
CentOS Security Tracker
So it appears that the Red Hat errata and CentOS errata are the same numbers.
This is Red Hat's format:
RHSA-YYYY-####
And this is CentOS' format:
CESA-YYYY:####
Where #### is the same number ...
- 4,737
8
votes
CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?
I feel that the other answers, while undoubtedly useful, do not answer exactly what you asked for... that is, whether Samba is running, but either whether Samba was installed at some time (by looking ...
- 22.5k
8
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
You are not required to request a CVE, but you are free to do so when you think it will be benificial.
A CVE is just a central number that identifies a vulnerability, which can assist when ...
- 28.6k
7
votes
How to subscribe to information about new vulnerabilities in selected products?
It is possible to make a custom list of products / vendors / keywords using Cassandra service from Purdue University. It is free and allows updates to be emailed.
- 71
7
votes
Did CVE-2016-2324 allowed remote code execution?
A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, ...
- 320k
7
votes
Accepted
CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?
It certainly looks likely it's not installed. Try checking with your package manager as to what's installed as a final check. But I would say it looks like it is not installed.
You could also do a ...
- 3,262
7
votes
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
I think the most important question is if your product comes with an auto-updater. If it auto-updates by default, then a CVE can sometimes do more harm than good by putting your product into the ...
- 1,799
6
votes
Accepted
Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat?
CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php
However, I'm not sure if there's a way to filter out only ...
- 86
6
votes
How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?
[Note: see the answer by @tim, which is a more thorough anwser than my quick google.]
MITRE has official documentation that answers your question right on cve.mitre.org, specifically have a look at ...
- 57.4k
6
votes
Are CVE counts a good indicator of a software's security?
As a voluntary system, CVE is as open to abuse as the software products it tracks and is often highly subjective. This is somewhat compounded by the scoring mechanism that's used to track severity ...
- 186
6
votes
CVE-2017-7494 Samba remote call. How do I know if Samba is running or not on my Ubuntu server?
You can check with $ dpkg -L samba
- 161
6
votes
Can A chain of exploits count as a CVE?
would the entire chain of them be eligible for A CVE or would each of
the individual one be eligible?
Each CVE is intended to represent a single vulnerability. Potential CVEs are more likely to be ...
- 71.7k
6
votes
How Vulnerability scanners assign CVE codes to Vulnerability found
Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to ...
- 1,086
6
votes
Accepted
Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?
After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon ...
- 870
6
votes
Accepted
How can we disable sudo on CentOS 6 to prevent CVE-2021-3156?
How to disable sudo on CentOS 6 to prevent CVE-2021-3156?
chmod 0644 /usr/bin/sudo will effectively disable sudo for non-root users. It removes the setguid bit, so sudo will work as epxected for ...
- 12.5k
Only top scored, non community-wiki answers of a minimum length are eligible