2

I came across an answer which suggest installing x tool which have a recently found a high priority security risk, so I edit it to add:

Update x ASAP: CVE-2021-nnnnn: High priority security vulnerability.

The user who answered the question revert the edit arguing:

I reverted your edit because security vulnerability info isn't really relevant to the question and somewhat ephemeral. Here's the link to the CVE alert that was removed: ubuntu.com/security/CVE-2021-nnnnn

I replied:

Being ephemeral doesn't make it less important. You could leave the security alert as long as it's relevant. Software with high priority security risks are relevant in this context.

But I wonder what other people think. Should we add this (necessary ephemeral) security alerts on questions or answers in which the main subject is around a software with a high priority vulnerabilities?

Edit: It seems there is a consensus that it should have been a comment. There is any case where should be an edit? What if there isn't a release patch yet?

2
  • Why not a comment?
    – Journeyman Geek
    Commented Sep 26, 2021 at 5:40
  • That's a valid alternative. Isn't this kind of issue relevant enough to be placed on a more visible place? I undoubtedly would go for a comment on a vulnerability with less priority, or if the tool was barely mentioned.
    – Pablo Bianchi
    Commented Sep 26, 2021 at 5:51

2 Answers 2

Reset to default
5

Well - while this started as a comment, it deserves a fuller answer so...

It should be a comment.

As per the help center

Add relevant but minor or transient information to a post (e.g. a link to a related question, or an alert to the author that the question has been updated).

While its 'important' in the 'greater scheme of things' - in most cases a known CVE isn't part of the main answer. Its something OP or someone else using the answer needs to be aware of but isn't actually part of the problem they are trying to solve.

It very much is what a comment is for - and its perfectly fit for purpose.

2

I will second what Journeyman Geek said: a comment is better. Especially since, in the specific case of CVE-2021-22204, the security vulnerability you pointed out, the issue has already been fixed in all supported Ubuntu versions: screenshot of the CVE page showing it has been patched for supported versions of Ubuntu

Since it has been patched, and in fact the patch was released back in June, well before your edit, it is no longer relevant and has no place in the answer. I would not even leave a comment, not for a patched one, but if you feel it is necessary for some reason, then a comment is the place for it.

2
  • I on purpose tried to keep my question general. Should be an edit on other cases? In which?
    – Pablo Bianchi
    Commented Sep 26, 2021 at 21:46
  • @PabloBianchi given that these things are almost always temporary, I can't easily imagine a situation where an edit would be appropriate. You would then have to make sure to come back and remove the edit once the vulnerability was fixed. Maybe an edit would be justified if it were an enormously dangerous vulnerability that would have a huge effect on the system, but those are very, very rare.
    – terdon
    Commented Sep 27, 2021 at 7:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .