Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 31 Mar 2010 20:39:10 +0200
From: Alex Legler <a3li@...too.org>
To: oss-security@...ts.openwall.com
Cc: jlieskov@...hat.com, "Steven M. Christey" <coley@...us.mitre.org>, Jan
 Lehnardt <jan@...che.org>
Subject: Re: CVE Request -- Apache CouchDB v.0.11.0 -- timing
 attacks flaw

Hi,

On Wed, 31 Mar 2010 19:26:38 +0200, Jan Lieskovsky
<jlieskov@...hat.com> wrote:

> 
> [1] references CVE-2008-2370 as CVE id, but CVE-2008-2370 is Apache
> Tomcat flaw: [6]
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370
> 
> Since Apache CouchDB is different code base, susceptible to the same
> issue as in [3], assuming new CVE identifier is required.
> 

Jan already posted a follow-up
(http://seclists.org/fulldisclosure/2010/Mar/554) to his message with
an updated ID: CVE-2010-0009

Alex

-- 
Alex Legler | Gentoo Security / Ruby
a3li@...too.org | a3li@...ber.ccc.de

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.