Undefined Behaviour as usual

Posted Feb 24, 2024 11:30 UTC (Sat) by Otus (subscriber, #67685)
In reply to: Undefined Behaviour as usual by jmspeex
Parent article: Stenberg: DISPUTED, not REJECTED

I can easily believe that the severity was wrong. But shouldn't that then be fixed?

I don't really know what the correct severity would've been here, but the severity part has always been black magic. (I don't think those are particularly useful in practice.)

My point is simply that CVE isn't supposed to be exclusively for highest impact issues, but any vulnerabilities.