Vulnerability Fixing Commit Predates Vulnerability Report

[nuthanmunaiah]

Description

According to NVD Report on CVE-2005-2728, CVE-2005-2728 was published on 08/30/2005. However, one of the vulnerability fixing commits, apache/httpd@4392210, in cves/CVE-2005-2728.yml has a commit date (11/27/2004) that predates the report of the vulnerability.

Note The issue no longer applies to CVE-2005-2728. See #103 (comment) below.

[nuthanmunaiah]

Another instance of the same issue is in cves/CVE-2007-5000.yml with the vulnerability fixing commit, apache/httpd@a19987c, having a commit date (04/07/2005) that predates the date of vulnerability report (12/13/2007).

(Potential) Cause: The issue may be caused by the mitigation implemented to overcome the practice of rewriting history that httpd seems to employ. The reason for this assessment is because in both instances of the issue, the offending vulnerability fixing commit has the note Formerly xxx before HTTPD rewrote Git history.

[nuthanmunaiah]

The issue is no longer applicable to CVE-2005-2728 because the vulnerability is reported to have been discovered on 2004-07-07T21:39Z making apache/httpd@4392210 a valid vulnerability fixing commit.

However, the issue is still applicable to cves/CVE-2007-5000.yml because one of the vulnerability fixing commits, apache/httpd@a19987c, is dated April 7, 2005 which predates vulnerability discovery of October 23, 2007 specified in cves/CVE-2007-5000.yml

[nuthanmunaiah]

Another instance of the same issue is in cves/CVE-2004-1834.yml with the vulnerability fixing commit, apache/httpd@59a6823, having a commit date (August 23, 2005) that predates the date of Release 2.0.53 (February 8, 2005) which is reported to include the fix for CVE-2004-1834.