[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 8 Aug 2013 13:28:39 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com,
David Walser <luigiwalser@...oo.com>
Cc: "lwn@....net" <lwn@....net>
Subject: Re: tomcat CVE confusion
On Wed, Aug 07, 2013 at 11:41:07AM -0700, David Walser wrote:
> OpenSuSE has issued an advisory for tomcat today:
> http://lists.opensuse.org/opensuse-updates/2013-08/msg00014.html
>
> This is also linked from LWN here:
> http://lwn.net/Vulnerabilities/562439/
>
> This CVE-2013-3544 is not mentioned on tomcat's security page:
> http://tomcat.apache.org/security-7.html
>
> But CVE-2012-3544 is mentioned there (note the different year).
>
> Based on this Novell/OpenSuSE bug report, I believe OpenSuSE made a typo:
> https://bugzilla.novell.com/show_bug.cgi?id=831119
>
> I can't find any info about CVE-2013-3544, but the mitre page says it's reserved. Perhaps that CVE has already been allocated for some other piece of software? If so, this might cause some confusion. I'm not sure how this should be handled, but I thought it would be appropriate to point this out.
Hi,
This is an unfortunate typo introduced by our packager that migrated to
the following process.
CVE-2012-3544 is the correct CVE.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
