Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: Re: CVE-2011-4858 confusion
From: Mark Thomas <markt () apache org>
Date: Thu, 05 Jan 2012 09:43:59 +0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/01/2012 20:02, Vincent Danen wrote:
* [2012-01-04 09:50:48 -0500] cve-assign () mitre org wrote:

MITRE is still working on this. Our current perspective is that 
CVE-2011-4084 is one vulnerability that was confirmed by the
upstream vendor, and CVE-2011-4858 is a different vulnerability
that was not confirmed by the upstream vendor. There are
apparently related test cases and test results that are not yet
public.

We received an email from upstream Tomcat asking us to make that
change. CVE-2011-4858 is the CVE for the hash collision issue.

I'm cc'ing Mark who made the original request to us.  Mark, could
you please clarify?

CVE-2011-4858 refers to the JVM hash collision vulnerability as it
affects Apache Tomcat.

The Apache Tomcat security team made the following announcement
regarding this issue:
http://markmail.org/message/jni4gb5biaolh66t

CVE-2011-4084 was going to be used for an DoS issue unrelated to hash
collisions but due to the confusion caused by oCERT incorrectly using
- -4084 rather than -4858 in their announcement of the hash collision
issue -4084 will be marked as rejected and a new CVE reference will be
used for the DoS issue unrelated to hash collisions. When the Tomcat
security team is ready to publish details of that issue, it will do so
under a completely new CVE.

Mark
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPBXDfAAoJEBDAHFovYFnnGXAP/1EX/c/AOyU8DEp+xjS0AP2y
9ZWrEXwVeA4uVwZyS3hexPZdz4bkPpk/7ptR1dZOvsuPcU9rrgGaL9m2pVUAjF2t
FwlyVC8Zv6rpICLYNhBeDaJ1v7lY/Dhznr/ZUCBpSh/CfrVI17YR4dwufeG47DkF
FsKz28O4+/mjtsJBQl1/CHPBM+XrwTlC4+Q/uPngz8NkbtbWWCzyeRDjymHBNRNZ
IUUXALBYISwNii3n7Rt9ctWM/irMX+3EfJmxa9Ijim+jIIwLwTK+NdBoSzwDNQTJ
m5l9WG+TbpDC/jm8+UhywQM6HDI5BgaoBCBPHUxnKLWtxioGNkwjk0xoNz3O+bce
wK3lr3WesEg78d1RpFvLh7eMLB9HrX7P/WFsmWODqH88OfHtvbvftegTj+5l4xcc
902zGicZ5vPQw/EfyzYrpvKYd1Owpu+r8EoMWO7SpARnrX1bmb+Z67kYYVOYZecC
uQEKMMC9uVyDaKFn8VyaNWOVZCCSYS9ngEAN/P3T5hF5NzbBtGRiuRsfqd3LglWG
jqnGcGXFzKzQ8QlZePh3PCKbNu88vvZlB8qxx2WUtXvAj5eDfG2/FNTZSLDbs7Af
0cuZqRUZ6BFOEQ493gZJFVtKq5eqYXAOAbBM9TmEZdCLIPPhh1aXYa6KGhDh5T4e
VBq5yJOimjf+zl6QUS4d
=UDhE
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault