Hello Chris,
On Mon, 14 Jun 2021 19:58:12 +1200
Chris Packham [off-list ref] wrote:
After some effort the description was updated to say "This flaw
affects syslog-ng versions prior to and including 2.0.9.". But the cpe
entry hasn't been updated (if I understand correctly the reporter
controls the description but nist controls the configurations). The
CVE entry does now say that it has been modified since it was last
analyzed so I'm not sure how/when that will happen.
How did you contact the NVD maintainers? Because I contacted them a few
weeks ago about some CVE details, and they fixed up like a few days
later.
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com