Re: Re: CVE-2011-4858 confusion

[Mark Thomas <markt () apache org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/01/2012 20:02, Vincent Danen wrote:
> * [2012-01-04 09:50:48 -0500] cve-assign () mitre org wrote:
>
> > MITRE is still working on this. Our current perspective is that 
> > CVE-2011-4084 is one vulnerability that was confirmed by the
> > upstream vendor, and CVE-2011-4858 is a different vulnerability
> > that was not confirmed by the upstream vendor. There are
> > apparently related test cases and test results that are not yet
> > public.
>
> We received an email from upstream Tomcat asking us to make that
> change. CVE-2011-4858 is the CVE for the hash collision issue.
>
> I'm cc'ing Mark who made the original request to us.  Mark, could
> you please clarify?

CVE-2011-4858 refers to the JVM hash collision vulnerability as it
affects Apache Tomcat.

The Apache Tomcat security team made the following announcement
regarding this issue:
http://markmail.org/message/jni4gb5biaolh66t

CVE-2011-4084 was going to be used for an DoS issue unrelated to hash
collisions but due to the confusion caused by oCERT incorrectly using
- -4084 rather than -4858 in their announcement of the hash collision
issue -4084 will be marked as rejected and a new CVE reference will be
used for the DoS issue unrelated to hash collisions. When the Tomcat
security team is ready to publish details of that issue, it will do so
under a completely new CVE.

Mark
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPBXDfAAoJEBDAHFovYFnnGXAP/1EX/c/AOyU8DEp+xjS0AP2y
9ZWrEXwVeA4uVwZyS3hexPZdz4bkPpk/7ptR1dZOvsuPcU9rrgGaL9m2pVUAjF2t
FwlyVC8Zv6rpICLYNhBeDaJ1v7lY/Dhznr/ZUCBpSh/CfrVI17YR4dwufeG47DkF
FsKz28O4+/mjtsJBQl1/CHPBM+XrwTlC4+Q/uPngz8NkbtbWWCzyeRDjymHBNRNZ
IUUXALBYISwNii3n7Rt9ctWM/irMX+3EfJmxa9Ijim+jIIwLwTK+NdBoSzwDNQTJ
m5l9WG+TbpDC/jm8+UhywQM6HDI5BgaoBCBPHUxnKLWtxioGNkwjk0xoNz3O+bce
wK3lr3WesEg78d1RpFvLh7eMLB9HrX7P/WFsmWODqH88OfHtvbvftegTj+5l4xcc
902zGicZ5vPQw/EfyzYrpvKYd1Owpu+r8EoMWO7SpARnrX1bmb+Z67kYYVOYZecC
uQEKMMC9uVyDaKFn8VyaNWOVZCCSYS9ngEAN/P3T5hF5NzbBtGRiuRsfqd3LglWG
jqnGcGXFzKzQ8QlZePh3PCKbNu88vvZlB8qxx2WUtXvAj5eDfG2/FNTZSLDbs7Af
0cuZqRUZ6BFOEQ493gZJFVtKq5eqYXAOAbBM9TmEZdCLIPPhh1aXYa6KGhDh5T4e
VBq5yJOimjf+zl6QUS4d
=UDhE
-----END PGP SIGNATURE-----