Assuming the curl dude actually makes some money selling services to people who have to do that reporting, he now has to not only show that the "high" CVE is fixed in the latest release, but go and back port a fix to all the versions that are being "maintained" for these customers who have to fill out reports about CVEs.
Even if all you have to do is respond to each with a "here's why this is bullshit", it still takes some time, time that could be better spent posting on HN.
Exactly. Last year, multiple CVEs were opened against node.js. They only impacted an experimental feature introduced in node 20, but NVD listed all versions of node as vulnerable (in contradiction with NVD's own summaries!). Many security tools treat NVD's word as gospel and refused to issue a correction in their findings, even though the erroneous reports were obvious and verifiable. It took multiple weeks for NVD to fix the entries despite receiving no doubt many emails about it.
Flaws in the CVE process waste tons of time, especially (it seems) at large orgs.
I’ve reported (and fixed) a number of security issues over the years. Sometimes I get them CVE numbers. I’ve never believed that MITRE or NVD added the slightest bit of value in their analyses.
The whole industry should recognize that CVEs are just a number. They are not, in and of themselves, worthy of entries on resumes, use in academic analyses, or much else. They simply identify an issue that may or may not be a security issue. There is an entire industry (of distros, etc) that triage issues and maybe deploy fixes, and for better or for worse that industry often requires a CVE number for its internal tracking.
So assigning a CVE number in general seems about as meaningful as assigning any other string. If I say “FOOBAR-12345: I don’t like how ‘curl’ is spelled”, then that means about what it sounds like, that is, not much.