Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Aug 2010 16:56:02 -0400 (EDT)
From: "Steven M. Christey" <>
cc: "Steven M. Christey" <>
Subject: Re: Qt SSL endless loop

Just to close this up.  I have actually preserved CVE-2010-2621 and have 
marked CVE-2010-2533 as a duplicate, which is contrary to what Vincent 

MITRE is ultimately the authority on which CVE should be rejected when 
duplicates arise.  See for the 
criteria that I generally follow (every once in a while, a behemoth 
"authoritative source" wins, though generally there is an expectation that 
their ID will become more ubiquitous in the future anyway.)

- Steve

On Mon, 19 Jul 2010, Vincent Danen wrote:

> * [2010-07-19 10:49:36 +0200] Ludwig Nussel wrote:
>> Vincent Danen wrote:
>>> * [2010-07-16 11:19:09 -0400] Josh Bressers wrote:
>>> >Please use CVE-2010-2533
>>> Wasn't this already assigned CVE-2010-2621?
>>> It links to the same advisory (qtsslame-adv.txt) and that only seems to
>>> be reporting one single problem.
>> Oops, indeed. We've overlooked that assignment. Sorry for the confusion :-/
> No problem.  We need to discard the new one then (discard CVE-2010-2621
> as a dupe of CVE-2010-2533).
> -- 
> Vincent Danen / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.