On Tue, Oct 27, 2026 at 12:31:41AM +0100, Marius Schwarz wrote: > > The kernel shows us, CVE is not everything, but thats only true for the > kernel, not for everything else.
There's a lot of other cases where there is a CVE, but it's not a big deal. Including, but not limited to: - The issue doesn't affect fedora builds at all (it's a fix for windows or the like) - The issue doesn't affect fedora builds because the way it's built (ie, we don't enable that feature, we don't use that dep, the dep we use is already fixed, etc) - Actual exploit of the problem is very difficult due to the way we build, or due to other protections like selinux or lto, etc Anyhow, I am just saying that "Oh, it's a CVE, push it immediately without testing it" is a bad idea and things are more nuanced. We should treat CVEs like any other bug and maintainers should evaluate how important it is to get them through the regular process. all IMHO, kevin -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
