oss-sec mailing list archives
tomcat CVE confusion
From: David Walser <luigiwalser () yahoo com>
Date: Wed, 7 Aug 2013 11:41:07 -0700 (PDT)
OpenSuSE has issued an advisory for tomcat today: http://lists.opensuse.org/opensuse-updates/2013-08/msg00014.html This is also linked from LWN here: http://lwn.net/Vulnerabilities/562439/ This CVE-2013-3544 is not mentioned on tomcat's security page: http://tomcat.apache.org/security-7.html But CVE-2012-3544 is mentioned there (note the different year). Based on this Novell/OpenSuSE bug report, I believe OpenSuSE made a typo: https://bugzilla.novell.com/show_bug.cgi?id=831119 I can't find any info about CVE-2013-3544, but the mitre page says it's reserved. Perhaps that CVE has already been allocated for some other piece of software? If so, this might cause some confusion. I'm not sure how this should be handled, but I thought it would be appropriate to point this out.
Current thread:
- tomcat CVE confusion David Walser (Aug 07)
- Re: tomcat CVE confusion David Jorm (Aug 07)
- Re: tomcat CVE confusion Kurt Seifried (Aug 07)
- Re: tomcat CVE confusion Marcus Meissner (Aug 08)
- Re: tomcat CVE confusion cve-assign (Aug 08)