Technology

59174 readers

2401 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

Possible Linux Severe CVSS 9.9/10 Unauthenticated RCE Flaw (sh.itjust.works)

submitted 1 month ago by hal_5700X@sh.itjust.works to c/technology@lemmy.world

7 comments fedilink hide all child comments

Simone Margitelli's post on the find

Margitelli posted a screenshot that implies he submit this bug to Canonical and Red Hat, who rated the vulnerability to have a CVSS of 9.9. If this is true, this bug would be more critical than the infamous Heartbleed, Spectre, and Meltdown exploits. Information is really limited right now about this bug, and also somewhat contradictory. I cannot find a public statement from Red Hat or Canonical confirming the existance of this bug, but have yet to deny it. This is typical for an exploit of this magnitude. However, according to Security Online, both insitutions have confirmed its severity.

Full disclaimer, this thing could be totally overhyped/overblown right now. Its going to take a few weeks before all the information comes out. It wouldn't be the first time a vulnerability has been overhyped to pressure the dev into fixing it. In the mean time, Linux users should make sure to keep their systems up to date.

you are viewing a single comment's thread
view the rest of the comments

[–] Alphane_Moon@lemmy.world 4 points 1 month ago

I have zero knowledge about the details and processes involved in security issue disclosure and even I get the feeling something is off about Margitelli's post.

He can let his findings speak for themselves when they are responsibly disclosed (and then start the sensationalism).