[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4ECCDCC4.4090700@redhat.com>
Date: Wed, 23 Nov 2011 12:45:08 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com,
"Steven M. Christey" <coley@...us.mitre.org>
CC: Kurt Seifried <kseifried@...hat.com>, Henri Salo <henri@...v.fi>,
cve@...re.org
Subject: Typo in description of CVE-2011-2708 and CVE-2011-4331? [was: Re:
Fwd: XSS vulnerability in Joomla 1.6.3 - CVE-2011-2710 / CVE-2011-2708
issue]
Hello Steve,
thank you for the clarification due this.
But according to latest CVE-2011-2708 and CVE-2011-4331 description
assignment, there seems to be a type (rounded / cycled definition of both):
======================================================
Name: CVE-2011-2708
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2708 [Open URL]
Final-Decision:
Interim-Decision:
Modified:
Proposed:
Assigned: 20110711
Category:
** REJECT **
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-2708. Reason:
This candidate is a duplicate of CVE-2011-2708. Notes: All CVE users
should reference CVE-2011-2708 instead of this candidate. All
references and descriptions in this candidate have been removed to
prevent accidental usage.
This one should mention 'CVE-2011-2710' in the body (based on the
reply below).
======================================================
Name: CVE-2011-4331
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4331 [Open URL]
Final-Decision:
Interim-Decision:
Modified:
Proposed:
Assigned: 20111104
Category:
** REJECT **
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-4331. Reason:
This candidate is a duplicate of CVE-2011-4331. Notes: All CVE users
should reference CVE-2011-4331 instead of this candidate. All
references and descriptions in this candidate have been removed to
prevent accidental usage.
This one should use "CVE-2011-4110" in the body, based on:
http://seclists.org/oss-sec/2011/q4/378
Could you correct these two yet? (not a big deal, just wanted to
point this out those two to be described correctly, even when being
duplicates).
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
On 11/23/2011 04:30 AM, Steven M. Christey wrote:
>
> Let's keep CVE-2011-2710 and we will reject CVE-2011-2708. Henri, I'm
> sorry about the lack of response :-(
>
> - Steve
>
>
> On Mon, 21 Nov 2011, Kurt Seifried wrote:
>
>>
>>> CVE-2011-2708 and CVE-2011-2710 are both about 20110701 XSS
>>> vulnerability:
>>> http://developer.joomla.org/security/news/357-20110701-xss-vulnerability.html
>>> and I have already contacted MITRE twice to get another one marked as
>>> obsolete.
>>>
>>>
>>> Best regards,
>>> Henri Salo
>>
>> Ok CVE-2011-2710 is public in CVE and NVD:
>> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2710, and
>> CVE-2011-2708 is still marked as reserved so we should probably quietly
>> take CVE-2011-2708 out back and shoot it.
>>
>> CC'ing mitre.
>>
>> --
>>
>> -Kurt Seifried / Red Hat Security Response Team
>>
>>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
