Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was looking through the OpenSSL vulnerabilities list and came across CVE-2010-5298 as a 2014 vulnerability.

At http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298, under Date Entry Created, it says 20140414.

However, under http://cve.mitre.org/cve/identifiers/syntaxchange.html, it clearly shows that format as CVE-YYYY-NNNN:

The CVE-ID Syntax Change took effect on January 1, 2014.

New CVE-ID Syntax

The new CVE-ID syntax is variable length and includes:

CVE prefix + Year + Arbitrary Digits

IMPORTANT: The variable length arbitrary digits will begin at four (4) fixed digits and expand with arbitrary digits only when needed in a calendar year, for example, CVE-YYYY-NNNN and if needed CVE-YYYY-NNNNN, CVE-YYYY-NNNNNNN, and so on. This also means there will be no changes needed to previously assigned CVE-IDs, which all include 4 digits.

I thought the year is always reflected in the CVE code. What happened in this case? Is this a common occurance?

share|improve this question

1 Answer 1

up vote 8 down vote accepted

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications.

Original bug report : https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.