5 ms·
You could regulate they have to patch any outstanding CVEs for their device/firmware but enforceability might be difficult.
by asynchronous 3y ago
You could regulate they have to patch any outstanding CVEs for their device/firmware but enforceability might be difficult.
- charcircuit 3y agoNot all CVE are real vulnerabilities.
- tkfu 3y agoThis would be an absolutely terrible standard. CVEs really, really suck. See, for example, this CVE for curl[1] that was assigned a 9.8. Or read sqlite's page on CVEs[2]. The sqlite issues alone would make this a non-starter, because you're not gonna convince everyone in every piece of software you use to update their version of sqlite. [1] https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-everything-that-is-wrong-with-cves/ https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-eve... [2] https://www.sqlite.org/cves.html https://www.sqlite.org/cves.html