Date: Fri, 20 Aug 2010 16:56:02 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: Qt SSL endless loop Just to close this up. I have actually preserved CVE-2010-2621 and have marked CVE-2010-2533 as a duplicate, which is contrary to what Vincent said. MITRE is ultimately the authority on which CVE should be rejected when duplicates arise. See http://cve.mitre.org/cve/editorial_policies/duplicates.html for the criteria that I generally follow (every once in a while, a behemoth "authoritative source" wins, though generally there is an expectation that their ID will become more ubiquitous in the future anyway.) - Steve On Mon, 19 Jul 2010, Vincent Danen wrote: > * [2010-07-19 10:49:36 +0200] Ludwig Nussel wrote: > >> Vincent Danen wrote: >>> * [2010-07-16 11:19:09 -0400] Josh Bressers wrote: >>> >>> >Please use CVE-2010-2533 >>> >>> Wasn't this already assigned CVE-2010-2621? >>> >>> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2621 >>> >>> It links to the same advisory (qtsslame-adv.txt) and that only seems to >>> be reporting one single problem. >> >> Oops, indeed. We've overlooked that assignment. Sorry for the confusion :-/ > > No problem. We need to discard the new one then (discard CVE-2010-2621 > as a dupe of CVE-2010-2533). > > -- > Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.