Getting Infinite CVEs via Software Supply Chain Security

The latest [Ivanti Connect Secure appliance exploit](https://www.cramhacks.com/p/cramhacks-22#:~:text=Ivanti%20Connect%20Secure%20appliances%20under%20active%20exploitation) is a perfect example of a major flaw in the vulnerability disclosure process.

In December, I wrote a blog post, [Getting Infinite CVEs via Software Supply Chain Security](https://www.cramhacks.com/p/infinite-cves-with-supply-chain), which made some people unhappy. But the latest Ivanti vulnerability is a perfect example of where shit hits the fan and why this needs to be talked about.

You have a vulnerability in a third-party package; in this case, CVE-2023-36661. Now, the Ivanti Connect Secure …

case connect cve cve-2024-21893 cves cybersecurity ivanti ivanti connect secure package party problem project reject run service service provider third third-party version vulnerability vulnerable