<![CDATA[What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy?]]>What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy?

]]>https://board.circlewithadot.net/topic/921e0a49-afe5-4576-94b3-5065fc87b616/what-would-be-the-biggest-downside-if-we-just-stopped-considering-severity-low-or-medium-security-bugs-cve-worthyRSS for NodeMon, 25 May 2026 16:09:50 GMTTue, 19 May 2026 14:17:03 GMT60<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 18:28:34 GMT]]>@bagder counter question what would be the downsides if we don't? Many organizations already have a hard time dealing with the vulnerability reports. They are drowning already in insignificant CVEs. And the situation isn't getting better. As a result important vulnerabilities aren't addressed as quickly as they could.

But on the other hand it's already questionable what's considered low, medium and high. Official scoring often does not match what an organization would do for themselves.

Whatever you do, for some people it will be negative. You have to balance the equation to be net positive. A really hard one to solve. Maybe even impossible to solve.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/securitym0nkey/statuses/116602654878098126https://board.circlewithadot.net/post/https://infosec.exchange/users/securitym0nkey/statuses/116602654878098126Tue, 19 May 2026 18:28:34 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 18:22:15 GMT]]>@bagder@mastodon.social I've seen security bugs considered lower severity because they affect only uncommon use cases, even if they're serious in those cases. Not assigning CVEs would make those harder to find.

Though, to my great annoyance, I recently found CVEs considered low priority (severity or otherwise) often aren't properly annotated in NVD anyway, which makes them rather useless for automated checks. But that's a problem of the database.

]]>https://board.circlewithadot.net/post/https://woem.men/notes/amgiy3j01gcn000jhttps://board.circlewithadot.net/post/https://woem.men/notes/amgiy3j01gcn000jTue, 19 May 2026 18:22:15 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 18:11:15 GMT]]>@bagder Anybody can request a CVE, not just upstream. It's less about project policy, if a real, medium-severity vulnerability doesn't have a CVE assigned, that basically just means nobody was bothered enough to request one.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/kpcyrd/statuses/116602586765057518https://board.circlewithadot.net/post/https://chaos.social/users/kpcyrd/statuses/116602586765057518Tue, 19 May 2026 18:11:15 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 17:46:38 GMT]]>@bagder Keep an ID, any ID.

I see them as globally unique identifiers that are used in "did you fix this thing" context. As naming things is hard and we will run out of catchy names and logos...

The severity indicates "fix now" or "fix tomorrow" or "next release". Thus the combo Id, severity, mitigatio & fix is important.

Curl could use CURL-SEC-2026-05-ABC and it would be fine too.

I just deployed a modprobe.d line for rds_tcp but no ID yet

/cc @adulau (for soliciting his opinions 😉 )
J

]]>https://board.circlewithadot.net/post/https://secluded.ch/users/jeroen/statuses/116602489967358092https://board.circlewithadot.net/post/https://secluded.ch/users/jeroen/statuses/116602489967358092Tue, 19 May 2026 17:46:38 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 16:00:31 GMT]]>@kpcyrd @bagder another note is even if a security relevant bug has low or medium significance to the security model of curl, it might still have significance to the security model of systems that use curl. Obviously it's user be ware, but it's harder to make those decisions when you can't easily distinguish between security bugs and other bugs.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rrdot/statuses/116602072715405318https://board.circlewithadot.net/post/https://infosec.exchange/users/rrdot/statuses/116602072715405318Tue, 19 May 2026 16:00:31 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:55:07 GMT]]>@kpcyrd @bagder this. If it doesn't matter that we have a common identifier to discuss security relevant bugs, then drop it. Otherwise keep em coming.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rrdot/statuses/116602051485348939https://board.circlewithadot.net/post/https://infosec.exchange/users/rrdot/statuses/116602051485348939Tue, 19 May 2026 15:55:07 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:54:19 GMT]]>@kpcyrd countless projects basically do this already, I don't think the world would fall over. It would be fewer CVEs to care about.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116602048299449629https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116602048299449629Tue, 19 May 2026 15:54:19 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:49:51 GMT]]>@bagder We would need to refer to bugs as "the buffer overflow that's in src/foo/bar.c line 1067 in version 4.5.6, and line 1058 in version 4.5.7" again.

Arch Linux wouldn't care, but it would make the life of Debian maintainers more difficult.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/kpcyrd/statuses/116602030769200251https://board.circlewithadot.net/post/https://chaos.social/users/kpcyrd/statuses/116602030769200251Tue, 19 May 2026 15:49:51 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:46:07 GMT]]>@bagder I'd prefer to know what issues exist, even if it's a bit noisier (on the blue team side)
Trying not to normalise the deviance of not fixing issues at my workplace

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/RichardoC/statuses/116602016073987427https://board.circlewithadot.net/post/https://infosec.exchange/users/RichardoC/statuses/116602016073987427Tue, 19 May 2026 15:46:07 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:37:38 GMT]]>@jacques some background: https://daniel.haxx.se/blog/2025/01/23/cvss-is-dead-to-us/

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116601982743609896https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116601982743609896Tue, 19 May 2026 15:37:38 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:36:36 GMT]]>@bagder well now I just feel silly for assuming!

]]>https://board.circlewithadot.net/post/https://mastodon.chester.id.au/users/jacques/statuses/116601978629819574https://board.circlewithadot.net/post/https://mastodon.chester.id.au/users/jacques/statuses/116601978629819574Tue, 19 May 2026 15:36:36 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:26:52 GMT]]>@bagder normalization of deviance, mostly, but it's probably nothing that the industry hasn't encouraged before

]]>https://board.circlewithadot.net/post/https://meow.social/users/frummidge/statuses/116601940377202812https://board.circlewithadot.net/post/https://meow.social/users/frummidge/statuses/116601940377202812Tue, 19 May 2026 15:26:52 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:22:20 GMT]]>@jacques we don't use CVSS, never did...

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116601922578382038https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116601922578382038Tue, 19 May 2026 15:22:20 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:19:33 GMT]]>@bms48 @bsdphk C89 is like my backyard and comfort zone. That's where I want to be.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116601911580417738https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116601911580417738Tue, 19 May 2026 15:19:33 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:16:42 GMT]]>@bsdphk The magic acronyms SAST and DAST post-date the writings of Dr. Jorgensen on Software Testing. And SonarQube might be a bit of a nothingburger if everyone is just using clang-tidy and cppcheck anyway. @bagder How can you maintain cURL as C89 and retain sanity? :^)

]]>https://board.circlewithadot.net/post/https://mastodon.social/ap/users/116175731239673526/statuses/116601900394389055https://board.circlewithadot.net/post/https://mastodon.social/ap/users/116175731239673526/statuses/116601900394389055Tue, 19 May 2026 15:16:42 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 15:04:43 GMT]]>@bagder macOS 15 still has curl 8.7.1. Those CVEs do not seem to have a lot of impact, if you ask me.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/icing/statuses/116601853258877595https://board.circlewithadot.net/post/https://chaos.social/users/icing/statuses/116601853258877595Tue, 19 May 2026 15:04:43 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:59:17 GMT]]>@bagder I mean CVSS is not a great scheme for ranking anyhow. Even v4 has the core problems of v3 (IMO)

]]>https://board.circlewithadot.net/post/https://mastodon.chester.id.au/users/jacques/statuses/116601831938779176https://board.circlewithadot.net/post/https://mastodon.chester.id.au/users/jacques/statuses/116601831938779176Tue, 19 May 2026 14:59:17 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:41:46 GMT]]>@bagder

A lot of "security researchers" would be sad that they couldn't pad their resumes with more CVE numbers ?

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/bsdphk/statuses/116601763027022984https://board.circlewithadot.net/post/https://fosstodon.org/users/bsdphk/statuses/116601763027022984Tue, 19 May 2026 14:41:46 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:32:56 GMT]]>@Ellie Indeed, and it also depends on the specific environment. In one of recent talks I've been to, it was mentioned that the medium severity CVEs, after analysis, had sometimes bigger impact than the high/critical ones. So I guess it really depends. But it won't be pretty regardless. @bagder

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/paulos/statuses/116601728332161962https://board.circlewithadot.net/post/https://infosec.exchange/users/paulos/statuses/116601728332161962Tue, 19 May 2026 14:32:56 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:31:33 GMT]]>@bagder I guess the scale would change. What's HIGH now, would end up on the LOW end of the remaining interval.. possibly resulting in people ignoring the issues.

I have faith in people messing this up, if given the opportunity.

]]>https://board.circlewithadot.net/post/https://indieweb.social/users/illuzive/statuses/116601722891646030https://board.circlewithadot.net/post/https://indieweb.social/users/illuzive/statuses/116601722891646030Tue, 19 May 2026 14:31:33 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:24:13 GMT]]>@bagder uhh, you sleep? that kinda seems like an upside though so it's impossible to say

]]>https://board.circlewithadot.net/post/https://xantronix.social/users/xan/statuses/116601694007795896https://board.circlewithadot.net/post/https://xantronix.social/users/xan/statuses/116601694007795896Tue, 19 May 2026 14:24:13 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:20:00 GMT]]>@bagder Eliminating low and medium CVEs wouldn't actually make software safer; it would just blindfold defenders. It turns out that a lot of "minor" leaks can still sink the ship if they are left unmonitored.

]]>https://board.circlewithadot.net/post/https://darmstadt.social/ap/users/116599928014652948/statuses/116601677465482188https://board.circlewithadot.net/post/https://darmstadt.social/ap/users/116599928014652948/statuses/116601677465482188Tue, 19 May 2026 14:20:00 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:19:35 GMT]]>@bagder it'd create a corollary for "if everything is urgent, then nothing is urgent": if low and medium severity bugs are ignored, then more bugs will be classified as high/critical.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/claus/statuses/116601675825975564https://board.circlewithadot.net/post/https://hachyderm.io/users/claus/statuses/116601675825975564Tue, 19 May 2026 14:19:35 GMT<![CDATA[Reply to What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy? on Tue, 19 May 2026 14:18:32 GMT]]>@bagder Probably none

Attackers can sometimes chain lower severity bugs together to do something interesting, but the reality is everyone is drowning in vulnerabiliites right now

Everyone has already written off Low and Medium as "don't care"

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/joshbressers/statuses/116601671652522653https://board.circlewithadot.net/post/https://infosec.exchange/users/joshbressers/statuses/116601671652522653Tue, 19 May 2026 14:18:32 GMT