mailing list archives
Re: Re: CVE-2011-4858 confusion
From: Mark Thomas <markt () apache org>
Date: Thu, 05 Jan 2012 09:43:59 +0000
-----BEGIN PGP SIGNED MESSAGE-----
On 04/01/2012 20:02, Vincent Danen wrote:
* [2012-01-04 09:50:48 -0500] cve-assign () mitre org wrote:
MITRE is still working on this. Our current perspective is that
CVE-2011-4084 is one vulnerability that was confirmed by the
upstream vendor, and CVE-2011-4858 is a different vulnerability
that was not confirmed by the upstream vendor. There are
apparently related test cases and test results that are not yet
We received an email from upstream Tomcat asking us to make that
change. CVE-2011-4858 is the CVE for the hash collision issue.
I'm cc'ing Mark who made the original request to us. Mark, could
you please clarify?
CVE-2011-4858 refers to the JVM hash collision vulnerability as it
affects Apache Tomcat.
The Apache Tomcat security team made the following announcement
regarding this issue:
CVE-2011-4084 was going to be used for an DoS issue unrelated to hash
collisions but due to the confusion caused by oCERT incorrectly using
- -4084 rather than -4858 in their announcement of the hash collision
issue -4084 will be marked as rejected and a new CVE reference will be
used for the DoS issue unrelated to hash collisions. When the Tomcat
security team is ready to publish details of that issue, it will do so
under a completely new CVE.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----