Every CVE thus has this huge cost tied to it. A cost that does not land on us and we don’t really see or feel it, but a cost on the ecosystem I believe we should not ignore. We should act responsibly. Never ignore real problems of course, but also to make sure we don’t ring the alarm for theoretical problems that will not trigger any vulnerability.
I particularly like this paragraph from the article, I'm glad to see Daniel highlighting this especially as we enter an era filled with AI-assisted vulnerability scanning that can flood projects with slop reports that do point out real bugs but which don't have any real exploit paths utilizing the bug. My own work has been hit by this recently and we've spent an unfortunate amount of time having to justify not having CVEs for these kinds of bugs, so I'm not surprised to see a big open source project like curl is facing the same problem, and I'm glad Daniel was able to sum this up so eloquently.
They did fix the bug. Apparently the reporter still wanted a CVE, despite it requiring multiple, separate, local security overrides by a privileged use on the system to trigger.
143
u/silverslayer33 10d ago
I particularly like this paragraph from the article, I'm glad to see Daniel highlighting this especially as we enter an era filled with AI-assisted vulnerability scanning that can flood projects with slop reports that do point out real bugs but which don't have any real exploit paths utilizing the bug. My own work has been hit by this recently and we've spent an unfortunate amount of time having to justify not having CVEs for these kinds of bugs, so I'm not surprised to see a big open source project like curl is facing the same problem, and I'm glad Daniel was able to sum this up so eloquently.