Date: Thu, 05 Jan 2012 09:43:59 +0000 From: Mark Thomas <markt@...che.org> To: Vincent Danen <vdanen@...hat.com> CC: oss-security@...ts.openwall.com, krahmer@...e.de, cve-assign@...re.org, Tomcat Security List <security@...cat.apache.org> Subject: Re: Re: CVE-2011-4858 confusion -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/01/2012 20:02, Vincent Danen wrote: > * [2012-01-04 09:50:48 -0500] cve-assign@...re.org wrote: > >> MITRE is still working on this. Our current perspective is that >> CVE-2011-4084 is one vulnerability that was confirmed by the >> upstream vendor, and CVE-2011-4858 is a different vulnerability >> that was not confirmed by the upstream vendor. There are >> apparently related test cases and test results that are not yet >> public. > > We received an email from upstream Tomcat asking us to make that > change. CVE-2011-4858 is the CVE for the hash collision issue. > > I'm cc'ing Mark who made the original request to us. Mark, could > you please clarify? CVE-2011-4858 refers to the JVM hash collision vulnerability as it affects Apache Tomcat. The Apache Tomcat security team made the following announcement regarding this issue: http://markmail.org/message/jni4gb5biaolh66t CVE-2011-4084 was going to be used for an DoS issue unrelated to hash collisions but due to the confusion caused by oCERT incorrectly using - -4084 rather than -4858 in their announcement of the hash collision issue -4084 will be marked as rejected and a new CVE reference will be used for the DoS issue unrelated to hash collisions. When the Tomcat security team is ready to publish details of that issue, it will do so under a completely new CVE. Mark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPBXDfAAoJEBDAHFovYFnnGXAP/1EX/c/AOyU8DEp+xjS0AP2y 9ZWrEXwVeA4uVwZyS3hexPZdz4bkPpk/7ptR1dZOvsuPcU9rrgGaL9m2pVUAjF2t FwlyVC8Zv6rpICLYNhBeDaJ1v7lY/Dhznr/ZUCBpSh/CfrVI17YR4dwufeG47DkF FsKz28O4+/mjtsJBQl1/CHPBM+XrwTlC4+Q/uPngz8NkbtbWWCzyeRDjymHBNRNZ IUUXALBYISwNii3n7Rt9ctWM/irMX+3EfJmxa9Ijim+jIIwLwTK+NdBoSzwDNQTJ m5l9WG+TbpDC/jm8+UhywQM6HDI5BgaoBCBPHUxnKLWtxioGNkwjk0xoNz3O+bce wK3lr3WesEg78d1RpFvLh7eMLB9HrX7P/WFsmWODqH88OfHtvbvftegTj+5l4xcc 902zGicZ5vPQw/EfyzYrpvKYd1Owpu+r8EoMWO7SpARnrX1bmb+Z67kYYVOYZecC uQEKMMC9uVyDaKFn8VyaNWOVZCCSYS9ngEAN/P3T5hF5NzbBtGRiuRsfqd3LglWG jqnGcGXFzKzQ8QlZePh3PCKbNu88vvZlB8qxx2WUtXvAj5eDfG2/FNTZSLDbs7Af 0cuZqRUZ6BFOEQ493gZJFVtKq5eqYXAOAbBM9TmEZdCLIPPhh1aXYa6KGhDh5T4e VBq5yJOimjf+zl6QUS4d =UDhE -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ