I was looking through the OpenSSL vulnerabilities list and came across CVE-2010-5298 as a 2014 vulnerability.
At http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298, under Date Entry Created, it says 20140414.
However, under http://cve.mitre.org/cve/identifiers/syntaxchange.html, it clearly shows that format as
The CVE-ID Syntax Change took effect on January 1, 2014.
New CVE-ID Syntax
The new CVE-ID syntax is variable length and includes:
CVE prefix + Year + Arbitrary Digits
IMPORTANT: The variable length arbitrary digits will begin at four (4) fixed digits and expand with arbitrary digits only when needed in a calendar year, for example,
CVE-YYYY-NNNNand if needed
CVE-YYYY-NNNNNNN, and so on. This also means there will be no changes needed to previously assigned CVE-IDs, which all include 4 digits.
I thought the year is always reflected in the CVE code. What happened in this case? Is this a common occurance?