<![CDATA[Did I miss that CVEs are allocated for supply chain compromises nowadays?]]>RE: https://mastodon.social/@cisakevtracker/116647846381979235

Did I miss that CVEs are allocated for supply chain compromises nowadays?

]]>https://board.circlewithadot.net/topic/75ab82e1-c262-432d-9b46-70c1774c3a00/did-i-miss-that-cves-are-allocated-for-supply-chain-compromises-nowadaysRSS for NodeSat, 06 Jun 2026 05:31:33 GMTWed, 27 May 2026 18:02:56 GMT60<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Thu, 28 May 2026 09:11:54 GMT]]>@GossiTheDog @campuscodi you're not wrong, but it seems CVEs are the go to mechanism for any security issue of software dependencies.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116651426718441108https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116651426718441108Thu, 28 May 2026 09:11:54 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Thu, 28 May 2026 08:43:24 GMT]]>@campuscodi it's pretty odd. They're not vulnerabilities... if you were affected, it'd be an incident - not an upgrade. CISA need to build a better system and process.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116651314683398917https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116651314683398917Thu, 28 May 2026 08:43:24 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 22:08:43 GMT]]>@GossiTheDog It's because of this, prolly. They've been added to the KEV so CISA can force agencies to clean out artifacts/compromised systems

https://mastodon.social/@campuscodi/116648324167478081

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/campuscodi/statuses/116648818990786052https://board.circlewithadot.net/post/https://mastodon.social/users/campuscodi/statuses/116648818990786052Wed, 27 May 2026 22:08:43 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 21:04:10 GMT]]>@GossiTheDog Weelll... If a particular version of a product has been Trojanized due to a supply-chain attack, it could be argued that this version contains a vulnerability now, no? And vulnerabilities are assigned CVEs.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/bontchev/statuses/116648565146216810https://board.circlewithadot.net/post/https://infosec.exchange/users/bontchev/statuses/116648565146216810Wed, 27 May 2026 21:04:10 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 20:07:52 GMT]]>@GossiTheDog Yeah its weird but it started last year from what I can tell.

Guess malware is a vulnerability now 💀

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/res260/statuses/116648343823469750https://board.circlewithadot.net/post/https://infosec.exchange/users/res260/statuses/116648343823469750Wed, 27 May 2026 20:07:52 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 20:06:07 GMT]]>@GossiTheDog the XZ backdoor for instance also got a CVE (CVE-2024-3094).

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116648336944606846https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116648336944606846Wed, 27 May 2026 20:06:07 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 19:44:12 GMT]]>@GossiTheDog they could of course also contribute to OSSF's malicious package DB instead. If it is a package like tanstack.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116648250707772338https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116648250707772338Wed, 27 May 2026 19:44:12 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 19:42:17 GMT]]>@GossiTheDog makes sense though if the package/software version is compromised? Whether the vulnerability stems from a bug or deliberately placed malware or backdoor, they are all vulnerabilities of some sort.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116648243205287593https://board.circlewithadot.net/post/https://infosec.exchange/users/thepwnicorn/statuses/116648243205287593Wed, 27 May 2026 19:42:17 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 19:28:46 GMT]]>@GossiTheDog Makes sense to me.

CVE are regularly used to actually block deployment pipelines, which is a useful function for mitigating supply chain vulnerabilities.

More generally, I wouldn't want to be forced to distinguish between active and passive threats and then not be able to label the active threats in a standard way.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/merospit/statuses/116648190079942640https://board.circlewithadot.net/post/https://infosec.exchange/users/merospit/statuses/116648190079942640Wed, 27 May 2026 19:28:46 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:55:23 GMT]]>@GossiTheDog
A CNA that is of organization type "Researcher" can issue CVEs for anything not explicitly in another CNA's scope.
Kaspersky is one such CNA.

Link Preview ImageLink Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116648058799140010https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116648058799140010Wed, 27 May 2026 18:55:23 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:40:02 GMT]]>@GossiTheDog yeah, and a whole bunch of Open Source projects have had to become CNAs to keep others from issuing bullshit CVEs. Hence https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/ and http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/ . Between that and NVD issuing CVSS scores that don't match what SMEs evaluate the same bugs as, and for that matter CVSS just being kind of bad in several ways, the whole scheme is starting to reek.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/vathpela/statuses/116647998394188069https://board.circlewithadot.net/post/https://infosec.exchange/users/vathpela/statuses/116647998394188069Wed, 27 May 2026 18:40:02 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:21:08 GMT]]>@GossiTheDog They found a way to justify AI costs?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/pauliehedron/statuses/116647924116283117https://board.circlewithadot.net/post/https://infosec.exchange/users/pauliehedron/statuses/116647924116283117Wed, 27 May 2026 18:21:08 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:18:57 GMT]]>@GossiTheDog Yes, since 2017ish, for example

Link Preview Image
NVD - CVE-2021-4229

favicon

(nvd.nist.gov)

Link Preview Image
NVD - CVE-2017-16054

favicon

(nvd.nist.gov)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/caspicat/statuses/116647915511607881https://board.circlewithadot.net/post/https://infosec.exchange/users/caspicat/statuses/116647915511607881Wed, 27 May 2026 18:18:57 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:15:37 GMT]]>@GossiTheDog oh yes, I cannot wait for this to pollute my vulnerability tracking and discovery. Oh yes this is what we all need. Hurt us more CISA daddy!!!

]]>https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115833042784456710/statuses/116647902390287384https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115833042784456710/statuses/116647902390287384Wed, 27 May 2026 18:15:37 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:11:14 GMT]]>RE: https://mastodon.social/@cisakevtracker/116647845255291135

It's not isolated, e.g.

There's a whole bunch of these now, it looks like companies are just yolo'ing out CVEs for other companies products.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116647885189751805https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116647885189751805Wed, 27 May 2026 18:11:14 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:06:37 GMT]]>@GossiTheDog And a 9.8, no less. Because why not just roll a dice on the CVSS score!

]]>https://board.circlewithadot.net/post/https://chaos.social/users/christopherkunz/statuses/116647867043828709https://board.circlewithadot.net/post/https://chaos.social/users/christopherkunz/statuses/116647867043828709Wed, 27 May 2026 18:06:37 GMT<![CDATA[Reply to Did I miss that CVEs are allocated for supply chain compromises nowadays? on Wed, 27 May 2026 18:05:35 GMT]]>@GossiTheDog wtf, someone needs to have a word with Kaspersky...

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116647862971525065https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116647862971525065Wed, 27 May 2026 18:05:35 GMT