Conversation

Notices

1. Embed this notice
   WWSchoof 📯 (wwschoof@layer8.space)'s status on Wednesday, 18-Dec-2024 23:49:27 JST WWSchoof 📯

   • Kevin Beaumont

   @GossiTheDog https://secalerts.co/vulnerability/CVE-2023-34990

   • Embed this notice
     WWSchoof 📯 (wwschoof@layer8.space)'s status on Thursday, 19-Dec-2024 00:02:25 JST WWSchoof 📯

     • Kevin Beaumont

     @GossiTheDog the nist link is neither telling the affected product, nor the fixed versions

   • Embed this notice
     Andrew Golding (huronbikes@cyberplace.social)'s status on Thursday, 19-Dec-2024 00:34:51 JST Andrew Golding

     • Kevin Beaumont

     @GossiTheDog sure does seem like a large number of directory traversal (or it's cousin, context escape) vulnerabilities lately...

   • Embed this notice
     Space Invader (spaceinvader@social.securitytheater.net)'s status on Thursday, 19-Dec-2024 03:55:37 JST Space Invader

     • Kevin Beaumont

     @GossiTheDog CNAs are not supposed to “backdate” CVEs like that. It was previously kinda-sorta allowed, but these days, a CNE doesn’t get a block of CVEs. CNAs inform MITRE of approximately how many CVEs they expect to issue in a year, and as you publish them, identifiers are assigned. If I publish two CVEs they may not be sequential.

     This CVE would have been in RESERVED status to hold onto the CVE-2023-34990 record. But wow, is that a long time before publishing.

     (I did CNA training in 2022)