Interesting discussion here. Who finds and releases CVE vulnerabilities when there is a fix? The vendor right? And when the vendor, or most likely the vendors customer encounters a breach due to a vulnerability we see a zero day CVE. But are vendors doing all they can to identify , notify and fix proactively? We’ve seen recently with vendors like Ivanti that’s not the case… old vulnerable code and library dependencies in outdated components were left unchecked for years. Time for a change perhaps 🤔
After six months, only one IBV vendor had properly fixed the #LogoFAIL issue at the date of the disclosure, Phoenix Technologies. However, the biggest challenge isn't fixing the reference code, it's delivering those fixes to all of the downstream vendors. Flip through the full report below to learn more.
