Re: tomcat CVE confusion

[David Jorm <djorm () redhat com>]

> OpenSuSE has issued an advisory for tomcat today:
> http://lists.opensuse.org/opensuse-updates/2013-08/msg00014.html
>
> This is also linked from LWN here:
> http://lwn.net/Vulnerabilities/562439/
>
> This CVE-2013-3544 is not mentioned on tomcat's security page:
> http://tomcat.apache.org/security-7.html
>
> But CVE-2012-3544 is mentioned there (note the different year).
>
> Based on this Novell/OpenSuSE bug report, I believe OpenSuSE made a typo:
> https://bugzilla.novell.com/show_bug.cgi?id=831119
>
> I can't find any info about CVE-2013-3544, but the mitre page says it's
> reserved.  Perhaps that CVE has already been allocated for some other piece
> of software?  If so, this might cause some confusion.  I'm not sure how this
> should be handled, but I thought it would be appropriate to point this out.

+1 I think it is a typo. The correct CVE ID is 2012-3544:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3544

David