If you're not a security person, the unspoken subtext here: the overwhelming majority of these "CVEs" do not matter to the project, and a very large number of them don't matter at all. They're pro-forma findings, like ReDOS in code paths that are rarely used, or, even more commonly, "prototype pollution" issues.
Are these real findings, or a situation in which fixes have been backported? At one place I worked, the corpsec guys were wildly incompetent and would try to bury me in "CVEs" in my systems that were nothing but "vulnerable" software versions with all of the "identified" vulnerabilities fixed by Debian backported patches.
I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
If you're not a security person, the unspoken subtext here: the overwhelming majority of these "CVEs" do not matter to the project, and a very large number of them don't matter at all. They're pro-forma findings, like ReDOS in code paths that are rarely used, or, even more commonly, "prototype pollution" issues.
Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
If the thing measuring whether there are CVEs is also the thing creating said CVEs, are we sure they are even CVEs? Deduped? Etc.
These are CVEs in the base image and in standard lib dependencies. For example, just scanned an unhardened image I built today:
Are these real findings, or a situation in which fixes have been backported? At one place I worked, the corpsec guys were wildly incompetent and would try to bury me in "CVEs" in my systems that were nothing but "vulnerable" software versions with all of the "identified" vulnerabilities fixed by Debian backported patches.
That’s not security, it’s compliance.
So the model found a fraction of the known vulnerabilities in 2.5 year old curl? Am I getting this right?
It’s like it’s made of CVEs. First 50-100 should be a good sign if it’s cleaner to start over.
Hold my beer
Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?
It's the opposite of NIH syndrome. Need to left pad a string? Just import a library from some rando on the internet!
Because, like it or not, it does Write Once, Use Anywhere better than Java ever did.
It is pretty much the lowest common denominator for code.
I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
This is how Vanta et al. make millions.
My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.
I don't understand the 'custom patch' strategy over 'fix the app with a major version change' strategy.
so s/bookworm/trixie/g didn't work then?
Yes, this is mostly a joke, I am able to understand the difference between base distros.
a spot on "joke". deb12 is gone for a month now.