Kulemba zigoli za CVE ndi chitetezo cha CVE ndizofunikira kwambiri poteteza mapulogalamu amakono ku ziwopsezo za pa intaneti zomwe zikubwera. Kuzindikira ndikuyika patsogolo zovuta kumathandiza mabungwe kuthana ndi zoopsa zazikulu poyamba. Kulemba zigoli za CVE kumapereka chidziwitso. standardnjira yowunikira zoopsa malinga ndi kukula kwake, pomwe njira zotetezera za CVE zimaonetsetsa kuti zoopsazo zikuyendetsedwa bwino ndikuchepetsedwa.
Mu 2025, Ma CVE 48,185 adasindikizidwa, Kuwonjezeka kwa 20.6% kuchokera pa 39,962 mu 2024, ndipo 38% adawerengedwa kuti ndi High or Critical severity. Popeza kuchuluka kwa voliyumu kukukula mofulumira chonchi, kukhala ndi CVE scoring yolimba komanso njira yotetezera sikulinso kosankha; ndi chofunikira.
Vuto lalikulu si kuchuluka kokha, koma kusanthula kwachikhalidwe sikungagwirizane ndi izi. NVD ya NIST idachulukitsa ma CVE pafupifupi 42,000 mu 2025, 45% kuposa chaka chapitacho, koma sizinali zokwanira kupitiliza ndi kuchuluka kwa zomwe zatumizidwa. Zotsatira zake mwachindunji, 28% yokha ya ma CVE atsopano omwe adawululidwa mu 2025 adalandira kuchuluka kwathunthu kwa NVD (chiwerengero cha CVSS, gulu la CWE, deta ya CPE), zomwe zidatsika kwambiri kuchokera pa 46.2% mu 2024. Manambalawa akuwonetsa kufunika kowonjezereka kwa mabungwe kukhala ndi njira zawo zachitetezo za CVE, m'malo modalira deta ya NVD yomwe ikufika panthawi yake.
Kodi Kulemba Ma Scoring a CVE N'chiyani Ndipo Chifukwa Chake Kuli Kofunika Pa Chitetezo cha CVE?
CVE imayimira Common Vulnerability and Exposures, mndandanda wa zofooka zachitetezo cha pa intaneti zomwe zawululidwa poyera komanso zowopsa. Cholembedwa chilichonse mu mndandanda wa CVE chimalandira chizindikiritso chapadera chotchedwa CVE ID, chomwe chimasonyeza makamaka kufooka. MITRE Corporation imayang'anira dongosololi, standardKudziwa momwe ziwopsezo zimazindikirika ndikusanjidwa m'ndandanda. Izi zimatsimikizira kuti aliyense amene ali mu chitetezo cha pa intaneti amagwiritsa ntchito mawu omwewo akamakambirana za ziwopsezo zinazake.
Kulemba zigoli za CVE kumaphatikizapo kuwunika momwe CVE iliyonse yalembedwera ndikugawa zigoli za manambala kutengera kuopsa kwake. Zigoli izi zimathandiza mabungwe kudziwa mulingo wofunikira kwambiri pothana ndi vuto.
Zimawathandiza kugawa bwino zinthu ndikuchepetsa zoopsa zomwe zingachitike. Dongosolo la CVE scoring system limawunika zinthu monga kugwiritsa ntchito mosavuta. Limaganiziranso za momwe zinthu zingakhudzire chinsinsi, umphumphu, ndi kupezeka (zomwe nthawi zambiri zimatchedwa "CIA triad"). Kuphatikiza apo, limawunikanso momwe zinthu zingakonzedwere.
Momwe NVD, Mndandanda wa MITRE CVE, ndi Kulemba Ma Scoring a CVE Zimagwirira Ntchito Pamodzi
Kumvetsetsa kulumikizana pakati pa National Vulnerability Database (NVD), Mndandanda wa MITRE, ndipo chitetezo cha CVE n'chofunikira kuti timvetse momwe zofooka zimayendetsedwa mu dongosolo la chitetezo cha pa intaneti.
Mndandanda wa MITRE CVE umayamba ndi kuzindikira zofooka ndikuzipatsa CVE ID. Komabe, mndandandawu umapereka chidziwitso choyambira chokhudza zofooka zilizonse. NVD, yoyendetsedwa ndi National Institute of Standards ndi Ukadaulo (NIST), imawonjezera deta iyi popereka mafotokozedwe atsatanetsatane, maumboni, ndipo chofunika kwambiri, CVE scoring kudzera mu Common Vulnerability Scoring System (CVSS).
NVD ndi chida chofunikira chifukwa chimagwira ntchito ngati malo osungira zinthu standardDeta yochokera ku chiopsezo yochokera ku s, yomwe imathandiza mabungwe kumvetsetsa momwe chiopsezo chimakhudzira bwino. NVD sikuti imangophatikizapo zigoli za CVSS komanso zambiri zakuya monga:
- Kufotokozera mwatsatanetsatane za chiopsezo chilichonse, kuphatikizapo tsatanetsatane waukadaulo ndi momwe chiopsezocho chingagwiritsidwe ntchito.
- Ziwerengero za zotsatira zomwe zikusonyeza momwe kufooka kungakhudzire mbali zosiyanasiyana za dongosolo la bungwe.
- Zambiri zokhudza kukonza monga maulalo opita ku ma patch, upangiri, ndi zochepetsera.
Chifukwa cha kukwanira kwake, NVD ndiye gwero lofunikira la mabungwe pamene akufunika kuwunika momwe vuto likuyendera komanso kumvetsetsa momwe angalithetsere bwino.
CVSS: Njira Yodziwika Kwambiri Yowerengera Ma CVE mu Chitetezo cha Paintaneti
Njira yomwe imagwiritsidwa ntchito kwambiri polemba ma CVE scoring ndi Common Vulnerability Scoring System (CVSS), yosamalidwa ndi kukonzedwa ndi Forum of Incident Response and Security Teams (FIRST). CVSS imapereka standardnjira yodziwira kuopsa kwa zofooka, zomwe zimapangitsa kuti mabungwe azisankha zomwe ayenera kuthana nazo poyamba.
Makamaka, CVSS imapeza ziwopsezo pa sikelo kuyambira 0 mpaka 10. Apa, 0 sikutanthauza chiopsezo ndipo 10 ikuyimira mulingo wapamwamba kwambiri wa kuopsa. Kuphatikiza apo, zigolizo zimachokera ku magulu anayi akuluakulu a metric:
Base Score:
Izi zikuwonetsa makhalidwe enieni a chiwopsezo chomwe chimakhalapo nthawi zonse komanso m'malo osiyanasiyana ogwiritsa ntchito. Chiwerengero cha maziko chimaganizira zinthu monga kugwiritsa ntchito mosavuta. Izi zikutanthauza momwe zimakhalira zosavuta kugwiritsa ntchito chiwopsezocho. Zimawunikanso momwe zimakhudzira chinsinsi, umphumphu, ndi kupezeka.
Zigoli Zakanthawi:
Izi zimasintha chiwerengero cha maziko kutengera zinthu zomwe zimasintha pakapita nthawi, monga ngati kukonza kulipo kapena ngati kugwiritsa ntchito njira yogwiritsira ntchito. Ziwerengero za nthawi zimaphatikizapo kukula kwa code yogwiritsira ntchito, mulingo wokonzanso, ndi chidaliro cha malipoti.
Environmental Score:
Izi zimathandiza mabungwe kusintha chiwerengero cha CVSS kuti chiwonetse momwe chiwopsezocho chikukhudzira malo awo enieni. Zimaganizira zinthu monga kufunika kwa dongosolo lomwe lakhudzidwa ndi kuwonongeka komwe kungachitike.
Gulu Lowonjezera la Metric:
Yayambitsidwa mu CVSS v4.0 ndipo imapereka nkhani yowonjezera yomwe ingakhudze kuwunika konse kwa zoopsa. Izi zikuphatikizapo zinthu monga zofunikira pachitetezo, ziwerengero zodziyimira zokha (zomwe zimayesa momwe automation imakhudzira kugwiritsidwa ntchito), ndi makhalidwe apadera omwe sangagwirizane ndi magulu ena a ziwerengero. Ngakhale kuti chiwerengero chonse cha CVSS sichikuphatikizapo ziwerengerozi, zimapereka chidziwitso chofunikira. Zotsatira zake, zimathandiza mabungwe kupanga chidziwitso chochulukirapocismfundo zokhudza kuyang'anira zofooka.
Mtundu waposachedwa, CVSS v4.0, imabweretsa zowonjezera izi kuti ziwongolere kulondola ndi kugwiritsidwa ntchito bwino kwa zigoli zofooka. Mwa kukonza bwino ziwerengerozi, CVSS v4.0 imagwira ntchito zovuta komanso nkhani za zigoli bwino kwambiri. Izi zimatsimikizira kuti zigolizo zimapereka chidziwitso chokwanira.cischiwonetsero cha chiopsezo chenicheni.
Chitsanzo cha Dziko Lenileni: CVE-2021-44228 (Log4Shell)
Kuti tifotokoze momwe kuwerengera kwa CVE kumagwirira ntchito, tiyeni tiwone CVE-2021-44228, yomwe imadziwika kuti Log4Shell. Kufooka kwa laibulale ya Apache Log4j 2 imalola kugwiritsa ntchito ma code akutali (RCE). Zotsatira zake, wowukira akhoza kulamulira makina omwe akhudzidwa.
- Chizindikiro cha CVE: CVE-2021-44228
- Chigoli cha CVSS: 10.0 (Yovuta)
- Attack Vector: Netiweki (N) - Itha kugwiritsidwa ntchito patali.
- Kuvuta kwa Kuukira: Low (L) - Yosavuta kugwiritsa ntchito.
- Maudindo Ofunikira: Palibe (N) - Palibe mwayi wofunikira.
- Kugwiritsa Ntchito: Palibe (N) - Palibe kuyanjana kwa ogwiritsa ntchito komwe kumafunika.
- Kukula: Yasinthidwa (C) - Imakhudza zinthu zomwe sizinali zomwe zinalipo poyamba.
- Chinsinsi, Umphumphu, Zotsatira za Kupezeka kwa Zinthu: Wapamwamba (H) - Kusokoneza kwathunthu chinsinsi, umphumphu, ndi kupezeka.
NVD inapereka chigoli cha CVSS cha 10.0, zomwe zikusonyeza kuopsa kwakukulu kwa vutoli. Kufalikira kwa vutoli, kuphatikiza kusavuta kugwiritsa ntchito, kunapangitsa kuti likhale lofunika kwambiri kuti likonzedwe padziko lonse lapansi.
Mavuto pa Kulemba Zigoli za CVE ndi Zotsatira Zake pa Chitetezo cha CVE
pamene Zovuta ndi Kuwonekera Kawirikawiri (CVE) System imapereka a standardNjira yodziwira ndikutsatira zofooka, zoletsa zingapo zimakhudza momwe imagwirira ntchito poyang'anira zoopsa.
CVE-2021-44228 (Log4Shell) akufotokoza mavuto awa:
- Tsatanetsatane Wochepa Wokhudza Kugwiritsa Ntchito Molakwika: CVE-2021-44228 imapereka chizindikiritso chapadera koma ilibe tsatanetsatane wa momwe owukira angachigwiritsire ntchito. Ngakhale akatswiri amaona kuti ndi chofunikira, zolemba za CVE sizikufotokoza bwino njira zenizeni zomwe owukira amagwiritsa ntchito kapena mawonekedwe enieni omwe amawonjezera chiopsezo. Kusiyana kumeneku kumasiya mabungwe osatsimikiza za chiopsezo chenicheni.
- Kusinthasintha kwa Malipoti: CVE Zolemba zimasiyana kwambiri mu zomwe zili mkati ndi mtundu wake. Zina, monga CVE-2021-44228, amapereka mafotokozedwe atsatanetsatane ndi chidziwitso chaukadaulo, pomwe ena amakhala achidule kapena osakwanira. Kusasinthasintha kumeneku kumavutitsa mabungwe akamayesa kuwunika chiopsezo cha munthu wofooka potengera CVE yomwe yalowa.
- Kusafunikira kwa Nkhani: CVE zolemba zimagwiritsa ntchito standardmawonekedwe omwe sangawonetse zomwe zikuchitika m'malo osiyanasiyana. Mwachitsanzo, CVE-2021-44228 Zimakhudza machitidwe mosiyana kutengera zomangamanga za kampani. Kusakhazikika kumeneku kumabweretsa kuwunika kolakwika kwa zoopsa ngati tsatanetsatane wa CVE sukugwirizana ndi malo enieni.
- Kuchedwa Kuwululidwa: Nthawi zambiri pamakhala kuchedwa pakati pa kupeza vuto ndi kuliwonjezera ku database ya CVE. Panthawiyi, owukira amatha kugwiritsa ntchito zofooka monga CVE-2021-44228 zisanadziwike kwa anthu onse, zomwe zimawonjezera chiopsezo chifukwa cha kuchedwa kwa chidziwitso ndi kukonza.
- Yang'anani pa Zovuta Zodziwika: CVE Zolemba zimangokhudza zofooka zomwe zawululidwa poyera, zomwe zimasiya zofooka za tsiku lopanda tsiku komanso zoopsa zomwe sizinaululidwe. CVE imaika mabungwe pangozi zomwe zikubwera zomwe databaseyo sinaziikebe m'ndandanda.
- Ubwino Wosasinthasintha wa Zolemba: Ubwino wa CVE zolemba zimasiyana malinga ndi komwe zachokera. Zina, monga CVE-2021-44228, amalandira zosintha nthawi zonse ndi tsatanetsatane watsopano, pomwe zina zimakhalabe zosasintha, zomwe zimapangitsa kuti pakhale kusagwirizana komanso mipata yomwe ingakhalepo mu data.
- Mndandanda wa zinthu zomwe zatsalira pa NVD Enrichment: Ngakhale CVE itasindikizidwa, palibe chitsimikizo choti idzapatsidwa mavoti nthawi yomweyo. Ma CVE 54,914 kuyambira 2024 mpaka 2025 adakali pamzere wa NVD akuyembekezera kusanthula kwathunthu. Mu Epulo 2026, NIST idalengeza kuti tsopano ipereka patsogolo kukulitsa ma CVE nthawi yomweyo mu CISKabukhu ka A's Known Exploited Vulnerability (KEV), mapulogalamu ogwiritsidwa ntchito m'boma la federal, ndi mapulogalamu ofunikira monga momwe tafotokozera mu Executive Order 14028. Zina zonse zimapindula pamlingo wabwino kwambiri, zomwe zikutanthauza kuti mabungwe ambiri sangaganizenso kuti CVSS ipezeka nthawi yomwe akuifuna kwambiri.
EPSS: Kupititsa patsogolo Chitetezo cha CVE pa Kasamalidwe Konse ka Zoopsa
CVE-2021-44228 ikuwonetsanso komwe Common Vulnerability Scoring System (CVSS)Ngakhale kuti ndi wolimba, amalephera. Kulephera kumeneku kukuwonetsa kufunika kwa Dongosolo Lowerengera Zolosera Pogwiritsa Ntchito Molakwika (EPSS).
Kodi EPSS ndi chiyani?
EPSS imagwiritsa ntchito njira yogwiritsira ntchito deta kuti ilosere kuthekera kogwiritsa ntchito zinthu zofooka monga CVE-2021-44228 mkati mwa masiku 30 otsatira. Mosiyana ndi CVSS, yomwe imayesa zotsatira zomwe zingachitike, EPSS imayesa kuthekera kwa kugwiritsidwa ntchito molakwika kutengera deta yakale ndi zomwe zikuchitika.
N’chifukwa Chiyani EPSS Ndi Yofunika?
- Kupititsa patsogolo Zinthu: EPSS zimathandiza mabungwe kuti aziika patsogolo zofooka osati kokha poganizira za kuopsa kwake komanso kuthekera kwa kuzunzidwa. Mwachitsanzo, magulu achitetezo akadziwa zimenezo CVE-2021-44228 ali ndi mwayi waukulu wogwiritsidwa ntchito molakwika, amaika patsogolo ntchito zokonzanso komwe akufunikira kwambiri.
- Chitetezo Chokhazikika: EPSS amalola magulu achitetezo kuchitapo kanthu popewa kuukira komwe kungachitike, zomwe zimachepetsa chiopsezo cha ziwopsezo zopambana.
- Contextual DecisKupanga ma ion: EPSS imapereka nkhani yowonjezera yomwe CVSS zokhazo zomwe zingaphonye, monga kuzindikira zofooka zomwe zikuwunikidwa ndi owukira. Izi zimapangitsa kuti pakhale njira zambiri zodziwira bwino komanso zogwirira ntchito.ciskupanga ma ion.
- Kukhathamiritsa Kwazinthu: Kwa mabungwe omwe ali ndi zinthu zochepa, EPSS zimathandiza kugawa bwino ntchito zothana ndi ziwopsezo zomwe zimawopseza kwambiri, ndikutsimikizira njira yodzitetezera yogwira mtima kwambiri.
Zofooka za EPSS
Ngakhale zabwino zake, EPSS Ili ndi zoletsa. Imadalira deta yakale, yomwe nthawi zina siingasonyeze momwe zinthu zilili panopa. Kuyang'ana kwake kwakanthawi kochepa pa kulosera za kugwiritsidwa ntchito mkati mwa masiku 30 kungalepheretse kuopsa kwa ziwopsezo za nthawi yayitali.
EPSS imapereka chidziwitso chonse popanda kufotokoza momwe zinthu zilili m'malo osiyanasiyana. Pomaliza, zimadalira njira zakale zogwiritsira ntchito, zomwe sizingawonetse kusintha kwachangu kwa njira zowukira kapena zofooka zomwe zapezeka kumene.
Kulinganiza CVE ndi EPSS kuti muyang'anire bwino zoopsa
Kuti mabungwe azitha kuthana ndi mavuto moyenera, ayenera kumvetsetsa ndi kuthana ndi zofooka za onse awiri CVSS ndi EPSSKuphatikiza zida izi kumapereka chithunzi chokwanira cha momwe zinthu zilili pa chiopsezo. Njira imeneyi imagwirizanitsa kuopsa kwa vutoli ndi kuthekera kogwiritsa ntchito molakwika, zomwe zimapangitsa kuti pakhale kuyika patsogolo zinthu, komanso kudziwitsa anthu za chitetezo.ciskupanga ma ion, komanso zotsatira zabwino za chitetezo cha pa intaneti.
Amathetsa Vuto Loika Patsogolo Mavuto Ovuta
Mu blog iyi yonse, tafufuza zovuta za CVE scoring, ntchito yofunika kwambiri ya National Vulnerability Database (NVD), ndi momwe zida monga Exploit Prediction Scoring System (EPSS) zimathandizira kuyang'anira kufooka mwa kulosera kuthekera kwa kuzunzidwa. Komabe, kuyang'anira kufooka bwino kumafuna zambiri kuposa kungomvetsetsa mfundo izi - zimafuna njira yokwanira yomwe imagwirizana ndi zosowa zachitetezo za bungwe lanu.
Kuchokera pafupifupi Zofooka 176,000 zodziwika, anthu opitilira 19,000 ali ndi CVSS score ya 9.0–10.0, zomwe zikutanthauza zoopsa zazikulu. Komabe, ambiri—pafupifupi 77.5%—ali mkati mwa 4.0 mpaka 8.0. Kugawa kumeneku kukuwonetsa vuto: loika patsogolo zovuta zomwe ziyenera kuthetsedwa kaye ndi momwe mungachitire izi ndi zinthu zochepa pamene mukukhalabe ndi chitetezo champhamvu.
Kusanthula kwa Kapangidwe ka Mapulogalamu a Xygeni (SCA) Yankho la funsoli limathetsa vutoli mwa kuphatikiza CVE scoring ndi EPSS ndi zida zina zokhudzana ndi nkhaniyi, kukupatsani chithunzi chonse cha momwe mukuvutikira. Yankho lathu limasanthula bwino ma codebase anu m'magwero osiyanasiyana, kuphatikiza NPM, GitHub, ndi OWD, kuonetsetsa kuti simukuphonya ziwopsezo zilizonse zachitetezo.
Momwe Xygeni's SCA Yankho Lasintha Kulemba kwa CVE Kukhala Ntchito
Mwa ma CVE 48,185 omwe adasindikizidwa mu 2025, 38% adayesedwa kuti ndi High kapena Critical severity, ndipo avareji ya CVSS ya chaka chino inali 6.60. Izi ndi zilembo zambiri "zofunikira" komanso "zapamwamba" zomwe zimapikisana pazinthu zochepa zokonzanso, ndipo izi zisanachitike chifukwa chakuti 28% yokha ya ma CVE a 2025 adalandira NVD yonse poyamba.
Kusanthula kwa Kapangidwe ka Mapulogalamu a Xygeni (SCA) Yankho limathetsa vutoli mwa kuphatikiza CVE scoring ndi EPSS ndi zizindikiro zina zokhudzana ndi nkhaniyi, kukupatsani chithunzi chonse cha malo anu ofooka, kutengera ngati NVD yayamba kale kuwonjezera CVE yanu. Imasanthula ma codebase anu kudzera pa npm, GitHub, ndi ma registry ena otseguka, kotero palibe chomwe chimadutsa mosazindikira.
Umu ndi momwe zimathandizira njira yanu yowongolera kufooka:
- Kulemba Zigoli za CVE + Kuphatikiza kwa EPSS. Kuphatikiza kuopsa (CVSS) ndi kuthekera kwa kugwiritsa ntchito (EPSS) kumatanthauza kuti gulu lanu limakonza kaye zomwe zikugwiridwa ntchito kuthengo, osati zomwe zimachita bwino kwambiri papepala.
- Kusanthula Kupezeka Kwa Anthu. Xygeni siimaima pa "CVE iyi ilipo mu mtengo wanu wodalira." Imatsimikiza ngati njira ya code yofooka ikupezeka mu pulogalamu yanu, ndikuchepetsa phokoso kwambiri ndikuwunikira kwambiri zoopsa zomwe zingachitike.
- Kudziwa za momwe zinthu zilili. Mwa kugwiritsa ntchito njira zosiyanasiyana zolangizira ndi njira zopezera zigoli nthawi imodzi, Xygeni imasintha malinga ndi malo enieni a bungwe lanu m'malo mogwiritsa ntchito zigoli zofanana ndi zonse.
- Kuwunika Kosalekeza & Zidziwitso za Nthawi Yeniyeni. Ma CVE atsopano ndi zigoli zatsopano za EPSS zimafalitsidwa nthawi zonse. Xygeni imayang'anira nthawi zonse, kotero kufooka komwe kunali kosafunika kwambiri dzulo, ndipo kukugwiritsidwa ntchito mwakhama lero, sikubisika.
Chotsatira: Popeza ma CVE atsopano opitilira gawo limodzi mwa magawo atatu awonetsedwa kale kuti ndi apamwamba kapena ofunikira, komanso kuchuluka kwa NVD kumachepera chaka chilichonse, kufufuza pamanja zomwe zapezeka sikoyenera. Xygeni imathandiza gulu lanu kuyang'ana kwambiri pa gawo laling'ono lomwe ndi lovuta komanso losavuta kugwiritsa ntchito m'malo mwanu.
Funsani Demo or Yambani kwaulere kuti tiwone momwe Xygeni ingasinthire CVE scoring kukhala njira yoyang'anira zoopsa zomwe ziyenera kuchitika.
Ibibazo
Kodi kusiyana pakati pa CVE, CVSS, ndi NVD ndi kotani?
CVE ndi chizindikiro chapadera cha chiwopsezo china. CVSS (Common Vulnerability Scoring System) ndi njira yowerengera yomwe imagwiritsidwa ntchito poyesa kuopsa kwa chiwopsezocho kuchokera pa 0 mpaka 10. NVD (National Vulnerability Database) ndi malo osungira, omwe amasungidwa ndi NIST, omwe amawonjezera CVE iliyonse ndi zigoli zake za CVSS, mafotokozedwe, ndi maumboni okonzanso.
Kodi EPSS ndi chiyani, ndipo imasiyana bwanji ndi CVSS?
EPSS (Exploit Prediction Scoring System) imayesa kuthekera kwakuti chiwopsezo chidzagwiritsidwa ntchito m'masiku 30 otsatira, kutengera deta yeniyeni yogwiritsira ntchito. CVSS imayesa kuthekera kwa kugwiritsa ntchito kusalekerera ngati agwiritsidwa ntchito molakwika; EPSS imayesa mwayi Kugwiritsa ntchito zonsezi pamodzi kumapereka chizindikiro cholondola kwambiri chokhazikitsa patsogolo kuposa chimodzi mwa ziwirizi.
Chifukwa chiyani si okwera kwambiri Kodi CVSS imapanga zigoli zokwanira kuti ipangitse kuti pakhale kufooka?
Chigoli cha CVSS chikuwonetsa kuopsa kwa malingaliro, osati chiopsezo chenicheni. Chiwopsezo cha "chovuta" cha zigoli 9.8 chomwe sichingapezeke mu codebase yanu yeniyeni, kapena chomwe sichidziwika kuti chikugwiritsidwa ntchito, chingakhale chofunikira kwambiri kuposa "chapakati" chomwe owukira akugwiritsa ntchito mwachangu pakadali pano. Ichi ndichifukwa chake kuphatikiza CVSS ndi EPSS ndi kusanthula kuthekera kofikira ndikofunikira.
Kodi ma CVE angati amafalitsidwa chaka chilichonse?
Kuchuluka kwa CVE kwakhala kukukulirakulira chaka ndi chaka, ndi zovuta zatsopano zambirimbiri zomwe zawululidwa chaka chilichonse. Popeza izi zikuchulukirachulukira, kukonza ma hand triage sikoyenera m'mabungwe ambiri, ndichifukwa chake kukhazikitsa zinthu mwadongosolo (CVSS + EPSS + reachability) kwakhala kofunikira.
Kodi CVE-2021-44228 (Log4Shell) ndi chiyani, ndipo n’chifukwa chiyani imagwiritsidwa ntchito ngati chitsanzo?
Log4Shell ndi vuto lalikulu la kugwiritsa ntchito ma code akutali mu Apache Log4j 2, lomwe linapeza 10.0 (pamwamba kwambiri) pa CVSS. Limagwiritsidwa ntchito kwambiri ngati chitsanzo chophunzitsira chifukwa limaphatikiza kugwiritsa ntchito ma network, palibe ma options ofunikira, komanso palibe kuyanjana kwa ogwiritsa ntchito, zomwe zikuwonetsa momwe "critical" imaonekera pansi pa CVSS framework.
