Re: tomcat CVE confusion

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/07/2013 12:41 PM, David Walser wrote:
> OpenSuSE has issued an advisory for tomcat today: 
> http://lists.opensuse.org/opensuse-updates/2013-08/msg00014.html
>
> This is also linked from LWN here: 
> http://lwn.net/Vulnerabilities/562439/
>
> This CVE-2013-3544 is not mentioned on tomcat's security page: 
> http://tomcat.apache.org/security-7.html
>
> But CVE-2012-3544 is mentioned there (note the different year).
>
> Based on this Novell/OpenSuSE bug report, I believe OpenSuSE made a
> typo: https://bugzilla.novell.com/show_bug.cgi?id=831119
>
> I can't find any info about CVE-2013-3544, but the mitre page says
> it's reserved.  Perhaps that CVE has already been allocated for
> some other piece of software?  If so, this might cause some
> confusion.  I'm not sure how this should be handled, but I thought
> it would be appropriate to point this out.

I can't comment on that CVE specifically but on the reserved thing:

http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures

Description[edit source | editbeta]
This is a standardized text description of the issue(s). One common
entry is:

** RESERVED ** This candidate has been reserved by an organization or
individual that will use it when announcing a new security problem.
When the candidate has been publicized, the details for this candidate
will be provided.

This means that the entry number has been reserved by Mitre for an
issue or a CNA has reserved the number. So in the case where a CNA
requests a block of CVE numbers in advance (e.g. Red Hat currently
requests CVEs in blocks of 500) the CVE number will be marked as
reserved even though the CVE itself may not be assigned by the CNA for
some time.




- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJSAv5vAAoJEBYNRVNeJnmTEgQQAJJe0EFOZLiYE9pSuZ7TSCth
7w5/Q+iArKakdyaz7w7WVf+POcQuKTc6/P2JJXquM4YSy7k82j+h6o4VCsRN+bvm
Elha1n4f0BYaXez+7G09aAAMZ6jKXLb30D5NxWnHQV9mABVTvn7VbW/Ehy+pevXJ
FWuj2cmZNHzFLmVyI/pmZUmwS9LwtPV9UA6IO9Ka024iF2OStuj0hwHWuBDtasMd
R9DPhTm2/gMOx1NqIBzi0GYdbRept5M4F17E4LN+mEJBvtQVhrr0wjU8ZwjrCbFv
QCBIHbqpHQjomtq7JdYoq9nyPLSP9M6E8n5WkRODYllgLDil76KKSJDXqKXI5edb
v2GhdifY86v8XgAiEU8SI0CY6mFWMhztG2WaOwyvmz0nnZ52XVbGeNAtqvdTuN0K
dCD06gnxyH4oZ7nu012hOGV9I+4n4wCBALQ+ql3hKZ43m4aLNqCA68OnbkD++2bG
B5I3fhfQ/HTd4dfGYWy1J4fcsTUAdpDw4nJSUjNcScAfI7URiXVINk6rHN06zQvc
x9jKHMCUMLxGgxMAmp/BZm3EzPS/T3TVOVJGnlQapc0DIrr1B/RGKyEBBMsMrBSZ
hSAIBunqnWf37Xo92vcXZbM3pcN1OeILdB/TSog2IMIHxG4vrrHgeEfuDnNpmxy9
utRHS4sjTS0eM1sY4Pn3
=yTEy
-----END PGP SIGNATURE-----