Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5990

Incorrect NVD severity ratings: (was: replacing misleading debian.org/security claims)

From max <maxwillb@mailfence.com>
Newsgroups linux.debian.security
Subject Incorrect NVD severity ratings: (was: replacing misleading debian.org/security claims)
Date 2022-01-10 02:00 +0100
Message-ID <DDRcu-7ff-5@gated-at.bofh.it> (permalink)
References <DzZBF-2LF-19@gated-at.bofh.it> <DC7Y5-7cX-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

January 5, 2022 7:20:46 AM CET Paul Wise <pabs@debian.org> wrote:

> Please send a patch, issue or mail about that separately.

Please see below:


The security tracker is listing incorrect NVD severity ratings. It looks like NVD tends to assign "medium" severity and later upgrades them, while Debian doesn't.

For example, see

https://security-tracker.debian.org/tracker/CVE-2021-30579
https://security-tracker.debian.org/tracker/CVE-2021-37973

that show "medium" severity, but are actually rated "critical" and "high" by NVD.

-- 
Sent with https://mailfence.com  
Secure and private email

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2021-12-30 10:10 +0100
  Re: replacing misleading debian.org/security claims Silas Cutler <Silas@BlackLab.io> - 2021-12-30 17:20 +0100
    Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
  Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
    Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-10 01:50 +0100
    Incorrect NVD severity ratings: (was: replacing misleading  debian.org/security claims) max  <maxwillb@mailfence.com> - 2022-01-10 02:00 +0100
    Re: replacing misleading debian.org/security claims Salvatore Bonaccorso <carnil@debian.org> - 2022-01-10 06:40 +0100
      Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-14 00:40 +0100
        Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-14 23:50 +0100
          Re: replacing misleading debian.org/security claims Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100
          Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-18 05:50 +0100
            Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-18 23:40 +0100
              Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-20 23:00 +0100
                Re: replacing misleading debian.org/security claims RP <reyadmin@gmail.com> - 2022-01-21 02:20 +0100
                Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-21 12:00 +0100

csiph-web