Vulmon
I think I can answer that. There's nothing technical going on here, it's down to the behaviour of the end users of
enterprise systems.
A lot of those people have a hard time understanding that they do actually want bug fixes and an even harder time
understanding that they need to actually do something to install those fixes. (I was once asked if I could fix a
problem without changing anything, anything at all when the fix was a one-off chmod.) A CVE number gets attention:
think of it as getting hold of the customer by the lapels and going nose-to-nose to explain in words of one syllable
they if they don't update their systems that they will crash and they will get hacked.
Ooh, no, they say, we can't possibly take the risk of updating our systems. Suppose something goes wrong? Sheesh.
Suppose, instead, someone comes along and sees a known, fixed bug is unfixed and uses that to trash your systems. Or
that you've got a bug that crashes the machine once a week for which there's a fix. But, no, apparently the mythical
risk of a tested update vs the actual quantifiable risk of leaving the bug unfixed is so great that they'd rather take
the real, quantifiable risk. I suppose that's understandable, after a fashion, even though actual regressions are
quite rare.
If you present a customer with a CVE number (with or without a score) then they have SLAs which will ensure that that
fix gets applied.
This is a long way from ideal -- people need to wake up and smell the coffee and get around to the idea that a system
that has not been updated in thirteen and a half years (not this one, another one) is not acceptable and they need to
get on and have an update system in place that will, dammit, keep them up to date. Until they do, a CVE is the best
way of getting attention.
Not that I'm bitter or anything.
jch