Re: Questionable CVE's reported against dnsmasq

[Jeremy Stanley <fungi () yuggoth org>]

On 2025-11-02 02:26:31 +0100 (+0100), Solar Designer wrote:
[...]
> It is interesting that although Red Hat seems to dispute this CVE and 
> doesn't intend to fix it, they nevertheless give it a non-zero CVSS 
> score
[...]

While I find CVSS fairly useless for projects I work on (for the 
same reasons Greg K-H eloquently explained in a recent post about 
determining the "severity" of Linux Kernel vulnerabilities), we have 
the concept of "vulnerabilities nobody's working on fixing" too. 
Off-label or discouraged uses of software, or even seemingly 
appropriate but not common uses, may lead to vulnerabilities which 
the maintainers have not prioritized finding solutions to in their 
limited available time. Maybe it's on the roadmap to solve 
eventually, or merely the upshot of ancient design decisions that 
can't be revisited due to conflicting backward compatibility 
promises.

Point is, it's possible to acknowledge something's technically a 
vulnerability, while having no plan to solve it in the immediate 
future. Does that merit a CVE? I wouldn't personally request one for 
it, but if a third party chose to assign one I wouldn't dispute it 
either. If people refuse to use software containing "unfixed CVEs" 
that's their choice.
--
Jeremy Stanley

Attachment: signature.asc
Description: