News for hackers. Stuff that matters.

A comment on Linux distros without systemd. Parent comment

Re:Linux distros without systemd by snazz on Monday May 20, 2019 @04:21PM (#19964744)
As marcosdumay said upthread, “Systemd has a historic of refusing to fill CVEs, even for incredibly bad vulnerabilities.”

This contributes to the low rate of CVEs in systemd relative to Linux (for which many less-important bugs get CVEs).

[ Parent | on HN ]
Re:Linux distros without systemd by the_why_of_y on Monday May 20, 2019 @05:51PM (#19965649)
A quick look at the list of CVEs in the grandparent comment indicates that there are at least 3 different Assigning CNAs for systemd CVEs: MITRE Corporation, Red Hat, Inc. and Canonical Ltd.

My conclusion is that the systemd project is not its own CNA and therefore not in a position to authoritatively decide which systemd bugs get CVE numbers assigned and which do not.

[ Parent | on HN ]