Post #2886323
2026-05-15 09:37 UTC
@aris@infosec.exchange @icing@chaos.social if its not RCE in a normal deployment - it's just a normal bug. Makes sense,
Replies (1)
-
@aris@infosec.exchange 2026-05-15 09:46
@stevel@hachyderm.io @icing@chaos.social There's more than RCE, e.g. heartbleed had a 8.6 cvss w/o RCE, but had aggravating factors that aren't evaluated by the CVSS scale, like how widespread the vulnerable configuration is. https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N In comparison, we have a 4-bytes uninitialized stack value leak in application logs bug to be reported soon. CVSS 3.1 Low https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N