Re: CVE Request for illumos distributions

["Steven M. Christey" <coley () mitre org>]

On Sat, 3 Jan 2015, Christos Zoulas wrote:

> On Jan 3,  6:57pm, cve-assign () mitre org (cve-assign () mitre org) wrote:
> -- Subject: Re: [oss-security] CVE Request for illumos distributions
>
> | > Illumos bug #5421 - http://illumos.org/issues/5421 which is now fixed in
> | > the upstream illumos-gate, is an innocuous fix to a serious problem that
> | > allows an arbitrary user in the global zone (non-global zones are not
> | > able to panic the machine) to panic the machine.
> |
> | Use CVE-2014-9491.
>
> Shouldn't we be using CVE-2015-XXXX by now?

This ID (and others) used a 2014 date because the bug report was 
technically public in 2014.  The year portion of a CVE ID typically 
reflects when the CVE was requested for non-public issues; or for 
already-public issues, the year portion typically reflects the year of 
disclosure.  The disclosure date itself can be a subject of 
interpretation, such as when an issue is disclosed at a 
publicly-accessible URL but only likely to be noticed by a limited 
audience ("technically public") versus when the issue becomes "widely 
public" to the infosec industry.

Especially in the transition from the end of one year to the beginning of 
the next year, there can be a mixture of dates.  Also, CVE (and every 
other vulnerability "database" or repository) frequently add entries for 
earlier years.  Accordingly, there is still a chance that CVE-2014-xxxx 
IDs will reach 5 digits, either in 2015 or later, as we continue to cover 
older issues that we discover or did not prioritize in earlier years.

- Steve