The Bogus CVE Problem
This resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)<p>A "security researcher" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as <i>Heartbleed</i> [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014. When I appealed to NVD for retraction (or whatever they do in this case), I never heard back, despite several emails / form submissions. It is not well-maintained. It is poorly managed. There is virtually no oversight. NVD is a trainwreck.<p>More recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like "cyber-nuclear meltdown" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 4 or 5 or something. So, again: There is virtually no oversight. NVD is a trainwreck.<p>Anyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone just tells me to patch my <whatever>, I'll probably do it, and that's good enough for me.<p>[0]: <a href="https://github.com/caddyserver/caddy/issues/4775">https://github.com/caddyserver/caddy/issues/4775</a><p>[1]: <a href="https://nvd.nist.gov/vuln/detail/cve-2014-0160" rel="nofollow noreferrer">https://nvd.nist.gov/vuln/detail/cve-2014-0160</a><p>[2]: <a href="https://matt.life/writing/the-acme-protocol-in-practice-and-reality" rel="nofollow noreferrer">https://matt.life/writing/the-acme-protocol-in-practice-and-...</a><p>[3]: <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-38198" rel="nofollow noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2023-38198</a>