[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CVE Collision in Microsoft advisory today w/ prior Jenkins disclosure (fwd)

Yup, that was one of Red Hat's, Jenkins posted a request with multiple issues to the distros list, amaris@redhat.com assigned that CVE as well as others on 2017-01-30 (give or take a half day because timezones and whatnot). You can see it's aliased in our BZ to the related bug:


On Tue, Apr 11, 2017 at 6:44 PM, jericho <jericho@attrition.org> wrote:
FYI for the other board members tracking CNA mistakes.

---------- Forwarded message ----------
From: Brian Martin <brian@opensecurityfoundation.org>
To: Microsoft Security Response Center <secure@microsoft.com>
Cc: Common Vulnerabilities & Exposures <cve@mitre.org>,
Date: Tue, 11 Apr 2017 18:43:09 -0600
Subject: CVE Collision in Microsoft advisory today w/ prior Jenkins disclosure



   Re-key admin monitor leaves behind unencrypted credentials in
   upgraded installations.

   SECURITY-376 / CVE-2017-2605


   2017-2605 | Defense-in-Depth Update for Microsoft Office
   Published: April 11, 2017

One of the CVE IDs you assigned today has already been assigned earlier this year to an issue in Jenkins. Can you please confirm that 2017-2605 is part of your CNA pool?

Jenkins CERT, if you have any records of where your assignment came from (e.g. directly from MITRE), could you share them to help resolve this?

Thank you,

Brian Martin

Kurt Seifried

Page Last Updated or Reviewed: April 12, 2017