alt Hacker NewsEven if the CVE doesn't currently apply to you, how can you be sure? Is the CVE in code that only runs on vmware; or does the code also run on EC2 - it will just be a few more weeks before someone figures out how to exploit it there.
Which is why the default answer for everybody should be fix the CVE. You should only ask "does this CVE affect us" in the case where the fix in some way is a negative to you.
Of course one downside might be risks of upgrading and so if you determine this affects us it means you would risk updating with less verification even though the update might break something else. If the issues doesn't affect you a longer process to verify nothing breaks is safe.
This becomes fun if you start to prioritize security work on CVEs rated higher, not affecting you, over security work on CVEs rated lower and affecting you.
Or prioritizing chasing CVEs currently not affecting you over architectural work improving security.
The CVE should be fixed, I fully agree, but where does it land as a priority? Less competent security teams push /all/ CVEs as Sev0 over /all/ other topics.