Why is the code CVE-2010-5298 used for a vulnerability discovered in 2014?

Question

I was looking through the OpenSSL vulnerabilities list and came across CVE-2010-5298 as a 2014 vulnerability.

At http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298, under Date Entry Created, it says 20140414.

However, under http://cve.mitre.org/cve/identifiers/syntaxchange.html, it clearly shows that format as CVE-YYYY-NNNN:

The CVE-ID Syntax Change took effect on January 1, 2014.

New CVE-ID Syntax

The new CVE-ID syntax is variable length and includes:

CVE prefix + Year + Arbitrary Digits

IMPORTANT: The variable length arbitrary digits will begin at four (4) fixed digits and expand with arbitrary digits only when needed in a calendar year, for example, CVE-YYYY-NNNN and if needed CVE-YYYY-NNNNN, CVE-YYYY-NNNNNNN, and so on. This also means there will be no changes needed to previously assigned CVE-IDs, which all include 4 digits.

I thought the year is always reflected in the CVE code. What happened in this case? Is this a common occurance?

Answer 1

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications.

Original bug report : https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest (Archive link https://web.archive.org/web/20140417192123/https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest)