"CVSS 10.0" isn't in the headline here and a CVSS of 10 doesn't actually mean anything.

phoe-krk 4 hours ago | parent | next [-]

Deeper in the article: https://docs.gitlab.com/releases/patches/patch-release-gitla...

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. (...)

CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Here, CVSS 10.0 means arbitrary remote code execution.

▲

tptacek 4 hours ago | parent [-]

"Arbitrary RCE" does mean something. "CVSS 10.0" does not. We should be using the article headline here.

▲

phoe-krk 4 hours ago | parent | next [-]

Truth be told, I don't think that "GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13" is a more descriptive title, even taking the HN guidelines into account. It could be better, sure, but it's not horrible (IMO).

	▲	tptacek 4 hours ago \| parent [-]
		It's an editorialization. The submitter is saying something about the importance of CVSS that the article does not. A better title would say "Remote Code Execution" where it says "CVSS 10.0" now.

▲

artooro 3 hours ago | parent | prev [-]

Good point guys, I've updated the title.

▲

ivanjermakov 4 hours ago | parent | prev | next [-]

Because "10 out of 10" is a better headline for the average reader than "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H".

▲

Retr0id 3 hours ago | parent | prev | next [-]

Sometimes CVSS 10 "oversells" the true severity of a bug but this doesn't seem to be one of those cases.

▲

TZubiri 4 hours ago | parent | prev [-]

>CVSS of 10 doesn't actually mean anything.

Might you perchance be exaggerating?

▲

tptacek 4 hours ago | parent [-]

No? CVSS is a Ouija board. Citrix directory traversal got scored 10.0. So did a Cisco Broadworks SSO bypass. Meanwhile, Shellshock did not.

CVSS is like the Pitchfork Music ratings scale. It communicates false precision, and it's easy to point to places where that precision misleads (D-plan's "Emergency & I" is not better than every Yo La Tengo album).

▲

TZubiri 3 hours ago | parent [-]

Have you read signal/noise theory? That a signal isn't perfect (that it contains false positives or positive falses in case of binary signals, or that it has a delta between the signal and the underlying phenomenon) doesn't mean that it carries no information.

For example if I cry wolf 50% of the time, but 100% of the times there's a wolf I cry wolf. Then no matter what the frequency of wolf sightings are, my crying wolf carries some information (unless there's always a wolf). Assume there's a wolf 1% of the nights, then I will cry wolf 50% of the time, and you only need to check for a wolf 50% of the nights rather than 100%.

It's worth noting that there's still technically signal even if I sometimes miss a wolf, even if you may choose to ignore that signal in order to pursue 100% accuracy yourself.

▲

nikanj 3 hours ago | parent [-]

It's more like: you work as an animal spotter, and if you tell people you saw a hamster, you'll get no glory. So obviously you spotted a direwolf at least 12 feet tall.

	▲	TZubiri 18 minutes ago \| parent [-]
		Interestingly CVSS was designed to help with this specific issue. You are complaining that the system is imperfect, but you fail to imagine how it works without such a system, everyone tagging their issue as critical. CVSS is good, it's better than nothing.