oss-sec mailing list archives
Re: Re: CVE-2011-4858 confusion
From: Mark Thomas <markt () apache org>
Date: Thu, 05 Jan 2012 09:43:59 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/01/2012 20:02, Vincent Danen wrote:
* [2012-01-04 09:50:48 -0500] cve-assign () mitre org wrote:MITRE is still working on this. Our current perspective is that CVE-2011-4084 is one vulnerability that was confirmed by the upstream vendor, and CVE-2011-4858 is a different vulnerability that was not confirmed by the upstream vendor. There are apparently related test cases and test results that are not yet public.We received an email from upstream Tomcat asking us to make that change. CVE-2011-4858 is the CVE for the hash collision issue. I'm cc'ing Mark who made the original request to us. Mark, could you please clarify?
CVE-2011-4858 refers to the JVM hash collision vulnerability as it affects Apache Tomcat. The Apache Tomcat security team made the following announcement regarding this issue: http://markmail.org/message/jni4gb5biaolh66t CVE-2011-4084 was going to be used for an DoS issue unrelated to hash collisions but due to the confusion caused by oCERT incorrectly using - -4084 rather than -4858 in their announcement of the hash collision issue -4084 will be marked as rejected and a new CVE reference will be used for the DoS issue unrelated to hash collisions. When the Tomcat security team is ready to publish details of that issue, it will do so under a completely new CVE. Mark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPBXDfAAoJEBDAHFovYFnnGXAP/1EX/c/AOyU8DEp+xjS0AP2y 9ZWrEXwVeA4uVwZyS3hexPZdz4bkPpk/7ptR1dZOvsuPcU9rrgGaL9m2pVUAjF2t FwlyVC8Zv6rpICLYNhBeDaJ1v7lY/Dhznr/ZUCBpSh/CfrVI17YR4dwufeG47DkF FsKz28O4+/mjtsJBQl1/CHPBM+XrwTlC4+Q/uPngz8NkbtbWWCzyeRDjymHBNRNZ IUUXALBYISwNii3n7Rt9ctWM/irMX+3EfJmxa9Ijim+jIIwLwTK+NdBoSzwDNQTJ m5l9WG+TbpDC/jm8+UhywQM6HDI5BgaoBCBPHUxnKLWtxioGNkwjk0xoNz3O+bce wK3lr3WesEg78d1RpFvLh7eMLB9HrX7P/WFsmWODqH88OfHtvbvftegTj+5l4xcc 902zGicZ5vPQw/EfyzYrpvKYd1Owpu+r8EoMWO7SpARnrX1bmb+Z67kYYVOYZecC uQEKMMC9uVyDaKFn8VyaNWOVZCCSYS9ngEAN/P3T5hF5NzbBtGRiuRsfqd3LglWG jqnGcGXFzKzQ8QlZePh3PCKbNu88vvZlB8qxx2WUtXvAj5eDfG2/FNTZSLDbs7Af 0cuZqRUZ6BFOEQ493gZJFVtKq5eqYXAOAbBM9TmEZdCLIPPhh1aXYa6KGhDh5T4e VBq5yJOimjf+zl6QUS4d =UDhE -----END PGP SIGNATURE-----
Current thread:
- CVE-2011-4858 confusion Sebastian Krahmer (Jan 04)
- Re: CVE-2011-4858 confusion cve-assign (Jan 04)
- Re: Re: CVE-2011-4858 confusion Vincent Danen (Jan 04)
- Re: Re: CVE-2011-4858 confusion Mark Thomas (Jan 05)
- Re: Re: CVE-2011-4858 confusion Vincent Danen (Jan 04)
- Re: CVE-2011-4858 confusion cve-assign (Jan 06)
- Re: CVE-2011-4858 confusion cve-assign (Jan 04)