Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by tptacek on Saturday March 20, 2021 @03:20PM
(#26525397)
Ubuntu is just taking the score from NVD. Redhat has applied the first Ouija input to it, adjusting it to "user interaction required". That changed the score from a 9.8 --- 0.2 points from the maximum possible CVSS score --- all the way down to... 9.6.
I can't think of a better illustration of how bad CVSS is.
Once again: my point isn't that the vulnerability is unimportant (though: it's not nearly as important as it likely seems) or that it doesn't belong on the HN front page (it is a very, very funny vulnerability). It's simply that we should not be editorializing CVSS scores into titles, or taking CVSS scores seriously when they occur organically in titles.
CVSS is very, very bad. It is the CISSP of security metrics.
I can't think of a better illustration of how bad CVSS is.
Once again: my point isn't that the vulnerability is unimportant (though: it's not nearly as important as it likely seems) or that it doesn't belong on the HN front page (it is a very, very funny vulnerability). It's simply that we should not be editorializing CVSS scores into titles, or taking CVSS scores seriously when they occur organically in titles.
CVSS is very, very bad. It is the CISSP of security metrics.