| ▲ | inigyou 2 hours ago |
| This is going to be fun for organizations that are mandated to patch all CVEs, isn't it? |
|
| ▲ | dgellow 44 minutes ago | parent | next [-] |
| One can hope that will put pressure on the industry to design a better system than CVEs. The signal noise ratio was already terrible before LLMs, I cannot imagine that will still be a meaningful system in 10y. But I’m too cynical to not consider all the middlemen who benefit from the status quo |
|
| ▲ | lucideer 2 hours ago | parent | prev | next [-] |
| I'm very curious what organisations would have such a policy. I can't imagine it being viable for any size of org without significant self-deception (or banning the use of all open source at which point CVEs are moot anyway). |
| |
| ▲ | traceroute66 an hour ago | parent | next [-] | | > I'm very curious what organisations would have such a policy. I would humbly suggest any org of any size that has insurance cover that covers anything tech related (e.g. data loss/recovery, cyber etc.) has a very good look at the small print. Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses. | |
| ▲ | clbrmbr 2 hours ago | parent | prev | next [-] | | Many orgs (esp w ISO27000) have a vulnerability management policy that involves patching at least critical CVEs within a short timeline. Tools like trivvy make it possible to do the scans… | | |
| ▲ | lucideer an hour ago | parent | next [-] | | I've been in such an org, & I've led initiatives to set up automated detection at very large scale. We started by issuing tickets to teams to resolve CVEs within varying timelines - ranging from a 24hr fix to 6 months - connected to the CVSS score. It wasn't viable. - Firstly, you quickly realise how irrelevant CVSS scores are - initiatives like First's EPSS are designed to fix this but they aren't there yet - Secondly, you need to begin implementing localised heuristics to determine exploitable code paths. This has generally been incredibly difficult to do reliably - LLMs have started to make it easier, but it's expensive. - Lastly, you need to factor in consideration of actionable remediation pathways. A dependency upgrade for critical infrastructure might contain breaking changes that take months to fix, or two competing CVEs might be present in interdependent versions of transitive dependencies in your sbom tree. Most orgs aren't applying any of the above three filters to reduce their CVE remediation burden, & even if they are, it's still too high to make zero a viable target. In reality, most orgs aren't doing comprehensive detection to begin with - if you haven't discovered all of your CVEs, your remediation burden is going to be a lot more manageable. | | |
| ▲ | mr_mitm an hour ago | parent [-] | | > - Firstly, you quickly realise how irrelevant CVSS scores are Even if you factor in the environmental score? I realize it's a lot more work, but it basically allows you to tune the score to get any value you want. | | |
| ▲ | michaelt 26 minutes ago | parent [-] | | Imagine a YAML parsing library that can cause an out-of-memory exception if you give it a YAML file greater than 3 megabytes. If you're an online service where untrusted users can submit arbitrary YAML, and an out-of-memory exception is a severe problem, then it's severity 10. If you're an online service that doesn't use yaml in any way, but your web framework bundled the library as a transitive dependency because yaml is one of their five supported configuration options, then it's severity 2. The problem is figuring out which of those situations you're in takes a load of time - and the flow of CVEs is endless, as CVE numbers are given out like candy at halloween. Often it's quicker to just update to the latest version of the YAML library. |
|
| |
| ▲ | dwedge an hour ago | parent | prev [-] | | > Tools like trivvy make it possible to do the scans... Only if you didn't rip trivvy out of your organisation when it had two supply chain compromises within a month of each other earlier this year |
| |
| ▲ | agilob 14 minutes ago | parent | prev | next [-] | | It's more common than many think https://old.reddit.com/r/kubernetes/comments/1vb3x2c/where_a... | |
| ▲ | regularfry 30 minutes ago | parent | prev | next [-] | | Any org large enough to have separated the people responsible for the security exposure of the organisation from the developers with familiarity of what's deployed is likely to have done exactly this. The thing you have to remember is that CVEs can be a) scanned for without exerting mental effort, and b) counted. | |
| ▲ | vrighter an hour ago | parent | prev | next [-] | | I have been given a list by security. "We had an automated tool scan that machine. It reported these. Fix anything medium severity and above. Never mind that some of them involved vulnerabilities in some part of the bluetooth stack (servers in our datacenter don't even have bluetooth). But they just didn't care | | |
| ▲ | ptx 28 minutes ago | parent [-] | | This does make some sense if it's considered a valid fix to document that you have verified that Bluetooth is disabled on the servers and therefore not vulnerable. But that assumes that the scanning tool can be told about this kind of fix, so that it stops warning about it, which I guess it might not. |
| |
| ▲ | michaelt an hour ago | parent | prev | next [-] | | SOC2 CC7.1 [1] requires a vulnerability scanner, findings tracked with tickets, assigned severities according to a documented risk-based system, severity-based SLAs for remediation, and that the SLAs mostly be complied with or have tracked exceptions. However it doesn't mandate any particular SLA, or the details of how risks are to be evaluated. Organisations get to write their own policy, and they don't need to commit to patching every CVE within 24 hours or anything like that. [1] https://www.compliancebase.org/controls/soc-2/cc7-1 | | | |
| ▲ | anygivnthursday 2 hours ago | parent | prev | next [-] | | If I remember correctly, we had to patch or provide justification for CVEs flagged by tools like AWS Inspector for SOC2 as well. | | |
| ▲ | YeahThisIsMe 2 hours ago | parent [-] | | So you didn't have to patch all of them. | | |
| ▲ | bluGill an hour ago | parent [-] | | No, but if you don't patch them you need to convince an auditor that they are not a problem. Often patching is easier. I'm working on such a problem now - we are using an old web browser (no longer supported) to show help on one system. That is web pages were generate internally, with no links elsewhere, and no provision for the user to enter a URL. It is still easier port to a newer supported browser than to convince the auditors that that we are not exploitable. Sure it is obvious that everything is internal and we won't write html that exploits bugs, but nobody wants to convince an auditor of that. |
|
| |
| ▲ | jeltz an hour ago | parent | prev | next [-] | | Many large organizations like banks have requirements like this and they solve it through a mix of automatic scanners, e.g. Trivvy, and self-deception as not all systems are actually scanned in any sufficiently large org. | |
| ▲ | SirFatty 2 hours ago | parent | prev | next [-] | | ITAR | | |
| ▲ | lucideer 2 hours ago | parent [-] | | ITAR has no such hard requirements. Might be some orgs that tell themselves they're attempting this under ITAR but they're not doing it in any comprehensive way. The only thing within ITAR that I'm aware of concerning itself with software supply chain is SP 800-218 requirements & that's just a load of open-to-interpretation weasel words about having CVE detection & automations in place & some defined plans for reducing the number of vulns. Pretty sure that component of it is even eligible for self-assessment. | | |
| ▲ | bluGill an hour ago | parent [-] | | Yes and no. ITAR (and other laws like it) are self assessment and don't specifically say thing thing. However your interpretation / self-assessment is subject to various reviews/audits. These days the reviewers are not going to be kind to someone who just says "not an issue", they will demand strong justification. Most organizations take the view that is is easier to fix all CVEs than try to pass audits. Thus by the letter of the law you are correct. However to meet the letter of the law without fixing CVEs is generally seen as harder than thus fixing CVEs. So the effect is ITAR (and similar laws) force you to fix CVEs. |
|
| |
| ▲ | ignore_prev an hour ago | parent | prev [-] | | [flagged] |
|
|
| ▲ | ymir_e 2 hours ago | parent | prev | next [-] |
| This was my first thought, this could be terrible if used offensively. The best defense I can imagine is to have an agent reproduce the issues before a human sees it, but even that will cost money. |
|
| ▲ | smitty1110 2 hours ago | parent | prev | next [-] |
| It’s honestly not great. The security guys are completely exasperated at my job, we’re wasting time having with these. You take the scam really, investigate for a bit, write up a DNF with justification, they go and up date records, and we all just kinda hope that someone updates the scans so it stops showing up. Something is going to give, and I suspect that the optimistic open filling is going to get canceled. |
|
| ▲ | 2 hours ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | whatevaa 2 hours ago | parent | prev | next [-] |
| Those organizations will have to adapt to new reality, ie, that some CVEs are not real. |
| |
|
| ▲ | cleansy 2 hours ago | parent | prev | next [-] |
| All organisations also have exceptions to policies. This one would be one |
| |
|
| ▲ | dns_snek an hour ago | parent | prev | next [-] |
| Steps to patch a hallucinated CVE: git stash -m "sigh"
git commit --allow-empty -m "Patch: CVE-2026-51302"
git stash pop
|
|
| ▲ | lelanthran an hour ago | parent | prev | next [-] |
| Not really. LLMs can hallucinate the patches too :-) |
|
| ▲ | ape4 2 hours ago | parent | prev [-] |
| Create the referenced but non-existent file and then fix it /s |
