Re: jetty CVE triage: jetty8 ignored?
On 2018-07-04, Ola Lundqvist <ola@inguza.com> wrote:
> You are right, CVE-2011-XXXX first found to affect jetty (jetty 6)
> could very well not be fixed in jetty 8 since jetty 8 was first
> released in 2009.
Even if jetty 8 had been first released in 2018, you *still* could not
conclude anything simply because "2011 is before 2018". All your
statements about "CVE-YYYY-XXX can't affect foo because foo was released
after year YYYY" are just plain wrong.
Cheers,
--Seb
Reply to: