Date: Wed, 31 Mar 2010 20:39:10 +0200 From: Alex Legler <a3li@...too.org> To: oss-security@...ts.openwall.com Cc: jlieskov@...hat.com, "Steven M. Christey" <coley@...us.mitre.org>, Jan Lehnardt <jan@...che.org> Subject: Re: CVE Request -- Apache CouchDB v.0.11.0 -- timing attacks flaw Hi, On Wed, 31 Mar 2010 19:26:38 +0200, Jan Lieskovsky <jlieskov@...hat.com> wrote: > >  references CVE-2008-2370 as CVE id, but CVE-2008-2370 is Apache > Tomcat flaw:  > http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370 > > Since Apache CouchDB is different code base, susceptible to the same > issue as in , assuming new CVE identifier is required. > Jan already posted a follow-up (http://seclists.org/fulldisclosure/2010/Mar/554) to his message with an updated ID: CVE-2010-0009 Alex -- Alex Legler | Gentoo Security / Ruby a3li@...too.org | a3li@...ber.ccc.de Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.