News for hackers. Stuff that matters.

A comment on CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows. Parent comment

Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by _jal on Tuesday November 01, 2022 @01:41PM (#33424596)
Only for major problems, and even then it seems iffy. I have trouble remembering which specific issue Meltdown actually refers to a couple years on.

Personally, I'm totally fine with CVEs. (And if people to stop acting like QIDs are interchangeable, that would be great, too.)

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by tptacek on Tuesday November 01, 2022 @01:43PM (#33424625)
You would have no connection to the underlying vulnerability whatsoever if I just mentioned CVE-2017-5754 to you.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by _jal on Tuesday November 01, 2022 @01:50PM (#33424747)
No, but I can establish context in about 10 seconds, and then it doesn't matter.

And you won't remember what WhizzyBadBug refers to in 5 years, you'll have to look it up. It'll only take you 10 seconds or so.

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by tptacek on Tuesday November 01, 2022 @02:02PM (#33424919)
I don't know. The example you chose was Meltdown. I think most people in the field heard Meltdown and can at least place it into the right bucket, of microarchitectural attacks. But more to the point: Meltdown in the moment was far more useful than a CVE number.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by juliusdavies on Tuesday November 01, 2022 @05:59PM (#33428170)
Without looking: Struts !!!! But not 100% sure I got it right.

Update: And I'm completely wrong. :-)

[ Parent | on HN ]