Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 30 Jun 2014 17:21:12 -0400 (EDT)
Subject: changing CVE ID for RH Bugzilla 1098222 (from CVE-2014-0235)

Hash: SHA1

CVE-2014-0235 should have been a completely valid CVE assignment from
Red Hat, but it would be extremely problematic to keep it because that
ID was accidentally used by Microsoft (typo of CVE-2014-0325) and is
in very widespread use for the wrong issue.

Can you assign one or more new CVE IDs for Red Hat Bugzilla 1098222
and send the CVE mapping here?

We're not sure how many vulnerabilities Red Hat is announcing in
1098222. Was the intention to have only one vulnerability and one CVE
for "the code before upstream version 5.19 tried to do regex matches
against an arbitrarily large amount of file content"?

We realize that
mentions "This fix is also insufficient" but it appears that all of
the discussion of incompleteness of a new fix occurred when 1098222
was embargoed, and also the upstream commit message didn't refer to
that first fix as security-related (the upstream commit message was
"further optimize awk by not looking for the BEGIN regex ..."). So,
this ordinarily wouldn't lead to any extra CVEs.

However, we don't know whether Red Hat is announcing any part of

as an additional vulnerability that was also fixed in 5.19.

If your intention was that everything related to regex matches is a
single vulnerability, then only one CVE ID is needed to replace

In a "REJECT" message for CVE-2014-0235, we can indicate the correct
per-product CVE IDs for the Internet Explorer and file/CPU-consumption

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.