Vulnerability Management and XZ Utils - Is there any hope?

I’ve never been so sure that vulnerabilities are both critical, and don’t matter at all. This last week was VulnCon in my very own Raleigh, NC. Overall, the main benefit was seeing just how human our vulnerability systems are; immediately after it was over, the latest CVE shows just how true that is. This week, we’ll cover a bit from the conference, and the wild ride that was CVE-2024-3094 - and how it shows that vulnerability management has never been more and less important than it is now. CVE-2024-3094 CVEs Don’t Matter CVEs Are Critical How do we Fix This? (It’s not ASPM) VulnCon Summary Latio Updates: The latest CVE, identified by an engineer at Microsoft and reported through RedHat, puts on full display the strengths and weaknesses of our CVE ecosystem. First, I put together a brief summary here of how to check if you’re vulnerable. Long story short, this CVE has all of the open source drama and intrigue you’d expect, while displaying how short we fall, despite the countless “sup

I’ve never been so sure that vulnerabilities are both critical, and don’t matter at all. This last week was VulnCon in my very own Raleigh, NC. Overall, the main benefit was seeing just how human our vulnerability systems are; immediately after it was over, the latest CVE shows just how true that is. This week, we’ll cover a bit from the conference, and the wild ride that was CVE-2024-3094 - and how it shows that vulnerability management has never been more and less important than it is now. CVE-2024-3094 CVEs Don’t Matter CVEs Are Critical How do we Fix This? (It’s not ASPM) VulnCon Summary L