Most complex applications have twist and turns and not all of the apply evenly across the installations. The CVSS score is use to summarize the overall risk, exploitability, and how commonly used the vulnerable is deployed. It is an imperfect scale but it is the one the industry has settled on. It is very annoying that you have chose to ignore it.
Darryl Baker, GSEC, GCLD (he/him/his) Sr. System Administrator Distributed Application Platform Services Northwestern University 4th Floor 2020 Ridge Avenue Evanston, IL 60208-0801 [email protected] <mailto:[email protected]> (847) 467-6674 <tel:+18474676674> On 8/28/26, 3:45 PM, "Christopher Schultz" <[email protected] <mailto:[email protected]>> wrote: Darryl, On 8/26/26 4:14 PM, Darryl Baker wrote: > I am trying to figure out when a vulnerability justifies and out of cycle > update to our Tomcat installations. After determining if we are vulnerable > then determining the risk but our security group focuses on the CVSS > score. With the Tomcat reports not including one I have little to go > by. Is there a rough mapping of your “Severity” and a range of CVSS > scores? Today I need to know is “Severity: important” a high enough risk > to justify an out of cycle update of our Tomcat installations? To answer your question directly: no such mapping exists. This is precisely because the level of severity will vary wildly between users. For example, if you don't use HTTP/2 at all than it doesn't matter if the CVSS score is a perfect-10. The Tomcat Security Team has tried to capture the overall severity for "most users". Some security announcements represented as "Low" by the Tomcat Security Team might end up being super important for you. To take a recent example: CVE-2026-65183. If you are using UNIX domain sockets in an adversarial environment, then the fix for CVE-2026-65183 is far more important to you than the "Low" severity we have assigned. But since most users are (a) not using UNIX domain sockets and (b) aren't in adversarial environments, the Tomcat Security Team has given this CVE a "low" rating. (After writing this and then reading Reg's reply, I find that I'm just saying the exact same thing. Hopefully, this repetition is actually helpful.) Another way to look at this would be "how painful is it to actually do a Tomcat upgrade"? I don't know what your patch/upgrade cycles look like, but if you invest some time and energy into making Tomcat upgrades cheaper or less onerous, then maybe it doesn't matter what the CVSS scores, etc. are. Just upgrade because it's easier than fighting with your Security Overlords. :) -chris --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] <mailto:[email protected]> For additional commands, e-mail: [email protected] <mailto:[email protected]>
