Re: tomcat CVE confusion

[Marcus Meissner <meissner () suse de>]

On Wed, Aug 07, 2013 at 11:41:07AM -0700, David Walser wrote:
> OpenSuSE has issued an advisory for tomcat today:
> http://lists.opensuse.org/opensuse-updates/2013-08/msg00014.html
>
> This is also linked from LWN here:
> http://lwn.net/Vulnerabilities/562439/
>
> This CVE-2013-3544 is not mentioned on tomcat's security page:
> http://tomcat.apache.org/security-7.html
>
> But CVE-2012-3544 is mentioned there (note the different year).
>
> Based on this Novell/OpenSuSE bug report, I believe OpenSuSE made a typo:
> https://bugzilla.novell.com/show_bug.cgi?id=831119
>
> I can't find any info about CVE-2013-3544, but the mitre page says it's reserved.  Perhaps that CVE has already been 
> allocated for some other piece of software?  If so, this might cause some confusion.  I'm not sure how this should be 
> handled, but I thought it would be appropriate to point this out.


Hi,

This is an unfortunate typo introduced by our packager that migrated to
the following process.

CVE-2012-3544 is the correct CVE.

Ciao, Marcus