Curl CVE insanity

[Tyrsson]

Absolute insanity:

 

[Empire]

Surely the idea that a software vendor can become a CNA, and effectively block anyone else from assigning CVEs to their products, is... not great? There's an obvious conflict of interest if (for example) Adobe is the only outfit which can issue CVEs for Adobe software, and they choose to downplay security issues.

 

[Tyrsson]

Well, for me, the crazy part of all that is the fact that they assigned such a high priority to something that has very minor implications to a package that is used by so many other vendors. Especially since it was addressed so long ago originally. It's a huge issue that can have real world ramifications for other software.