CVE-2025-23087

Posted by Pete Allor on Jan 28Florian, I think you miss what actually is done and how, with whom / what. Pete

Posted by Florian Weimer on Jan 28* Pete Allor: But is this really how it works these days? For example, if we use a component to render the in-program documentation (traditionally called “online help”, but we would consider this offline today), and the upst…

Posted by Pete Allor on Jan 27Florian, The question is about who is scoring and a level of their knowledge and understanding. Assuming that each is using CVSS v3.1 then the question is does the scoring entity look at how the component is built and used or are…

Posted by Florian Weimer on Jan 26* Pete Allor: The larger problem is that component scoring tends to be higher than whole-system scoring. If a security component fails in its security function, it certainly deserves an impact rating that reflects that it's …

Posted by Pete Allor on Jan 25Assigning a CVE for EOL is actually outside the normal practice (there is another standard for that underway) and is not in line with Rule 4.1 as part of the CVE program. I do agree with Greg K-H that open source projects should…