CVE Collision in Microsoft advisory today w/ prior Jenkins disclosure (fwd)

[jericho <jericho@attrition.org>]

FYI for the other board members tracking CNA mistakes.

---------- Forwarded message ----------
From: Brian Martin <brian@opensecurityfoundation.org>
To: Microsoft Security Response Center <secure@microsoft.com>
Cc: Common Vulnerabilities & Exposures <cve@mitre.org>,
    jenkinsci-cert@googlegroups.com
Date: Tue, 11 Apr 2017 18:43:09 -0600
Subject: CVE Collision in Microsoft advisory today w/ prior Jenkins 
disclosure


Microsoft,

https://jenkins.io/security/advisory/2017-02-01/

   Re-key admin monitor leaves behind unencrypted credentials in
   upgraded installations.

   SECURITY-376 / CVE-2017-2605

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/2017-2605

   2017-2605 | Defense-in-Depth Update for Microsoft Office
   Published: April 11, 2017

One of the CVE IDs you assigned today has already been assigned earlier this 
year to an issue in Jenkins. Can you please confirm that 2017-2605 is part of 
your CNA pool?

Jenkins CERT, if you have any records of where your assignment came from (e.g. 
directly from MITRE), could you share them to help resolve this?

Thank you,

Brian Martin