News for hackers. Stuff that matters.

A comment on Linux distros without systemd. Parent comment

Re:Linux distros without systemd by telmich on Monday May 20, 2019 @10:10AM (#19960452)
Do you have a source for it?
[ Parent | on HN ]
Re:Linux distros without systemd by markstos on Monday May 20, 2019 @10:19AM (#19960544)
In 2017, the Linux Kernel had over 450 CVEs, while systemd had 5.

https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm... https://www.cvedetails.com/vulnerability-list/vendor_id-7971...

So far in 2019, the gap has narrowed: "only" 45 CVEs so far for the Linux kernel, and 7 for systemd.

[ Parent | on HN ]
Re:Linux distros without systemd by snazz on Monday May 20, 2019 @04:21PM (#19964744)
As marcosdumay said upthread, “Systemd has a historic of refusing to fill CVEs, even for incredibly bad vulnerabilities.”

This contributes to the low rate of CVEs in systemd relative to Linux (for which many less-important bugs get CVEs).

[ Parent | on HN ]
Re:Linux distros without systemd by the_why_of_y on Monday May 20, 2019 @05:51PM (#19965649)
A quick look at the list of CVEs in the grandparent comment indicates that there are at least 3 different Assigning CNAs for systemd CVEs: MITRE Corporation, Red Hat, Inc. and Canonical Ltd.

My conclusion is that the systemd project is not its own CNA and therefore not in a position to authoritatively decide which systemd bugs get CVE numbers assigned and which do not.

[ Parent | on HN ]
Re:Linux distros without systemd by PlutoIsAPlanet on Monday May 20, 2019 @10:14AM (#19960491)
Sure

https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...

https://www.cvedetails.com/product/38088/Freedesktop-Systemd...

For a piece of software used by millions of machines, that's a very low CVE count.

[ Parent | on HN ]