You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by David Dillard <Da...@veritas.com> on 2017/03/16 14:25:59 UTC
CVEs Not Published
Apologies if this is a duplicate, but I don't see this message in the archive so I'm resending.
Hi,
I was recently reviewing Tomcat vulnerabilities and I noticed that it appears that several CVEs for Tomcat going back to at least September of last year have not been published by Mitre. A few examples:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8745
Does anyone know why they haven't been published? And more importantly, does anyone know how to get these published?
We use some tools to help us identify vulnerable versions based off of CVEs published in the NVD and not having them be published for so long is causing some problems.
Regards,
David
Re: CVEs Not Published
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
David,
On 3/16/17 10:25 AM, David Dillard wrote:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816
I was working on updating this one. I've sent a notification to Mitre
with all the details.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJYyqj9AAoJEBzwKT+lPKRYsoMP/1Np1duQWNaV1QSQvC76rOiy
GT5qH8ZBBdk+CWa0Kg7Vly8xnhhYCIgH89zUP+t+kLXSWeb4l50eNuQ09ZflcdIs
Iq01A72Zz7LybpGMA1rZa0QmsWwtVxIO6LcI3SpVsDaKZMmZfvTIQbk2u5JyWElW
MSn5Hm5KQHY8zMyDqiZK2jJ2QR/xjfKmqF18/eBAW1F0Qog5zNTGtTUIPrEPIHTF
ThCROkbnDmjmnWKboti7SWcLk1YfpL4ttD5x9okkGekYyVWdzyB0TgQL/UXQBKeO
KESD5hZR17bUdtxzzJ1k9imYM/zfSS1BG+cA9ZFW6wfM461dulotX1XOj28AG/OJ
GsMA3/Gi7twPaJ0fktqH3tJk8sYVDukMxIr2wnt47/IqczHcDJm7PN/Oa/Xhvzoh
7Hw00If4/LmGB//H18luKq3MRnxWhZuE8KqeUcpPFDVLzm9AsWCLVV1Nh6hUcHdV
JPpvyddHPpSC3cmoJWzqhkv5r5phGZ97RO1pQEYM2nYEKoAeHrTCFqL8EWcXhnVY
SwRt0mTMwjuOAzd3hbsbqrEGRVBjz7I5r+1Wi/HhPxH8jdS2tBewsqeKCfq69kWb
4O0kB6118/Ae8bE4IviVSsqkgWVrRbFe0tlLkdd2f55GBbGZRVVO/Z26J6ZxU+Da
HbQIUCuhMSA/u0NDmXKr
=e0ly
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: CVEs Not Published
Posted by Mark Thomas <ma...@apache.org>.
On 16/03/17 14:25, David Dillard wrote:
> Apologies if this is a duplicate, but I don't see this message in the
> archive so I'm resending.
>
>
> Hi,
>
> I was recently reviewing Tomcat vulnerabilities and I noticed that it
> appears that several CVEs for Tomcat going back to at least September
> of last year have not been published by Mitre. A few examples:
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6816
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8745
>
> Does anyone know why they haven't been published?
At some point last year Mitre stopped populating their database from
information posted to bugtraq. Prior to that, population was sometimes
timely, sometime not.
There was no advance warning of this that I am aware of. I have a little
more insight now the ASF is a CNA but not much.
> And more
> importantly, does anyone know how to get these published?
The process has changed and now the projects need to submit this
themselves. See http://www.apache.org/security/committers.html step 15.f)
The ASF was provided with a list of CVEs that were issued in the time
between Mitre stopped populating their database from bugtraq and Mitre
informed the ASF of the new process (from memory this covers a period of
months). The ASF has provided the necessary data. When it is loaded is
up to Mitre.
Anyone can submit CVE information via the process indicated above.
> We use some tools to help us identify vulnerable versions based off
> of CVEs published in the NVD and not having them be published for so
> long is causing some problems.
You can try submitting them yourselves. Turnaround seems to be fairly
quick. At least CVE-2016-8747 is listed which I submitted a few days ago.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org