Security Bulletin: Vulnerability of Embedded CF CLI In IBM Cloud CLI

Summary

Default embedded CF CLI in IBM Cloud CLI version prior to 0.20.0 contains a security vulnerability which might expose customer credentials.

Vulnerability Details

CVEID:CVE-2019-3800
**DESCRIPTION:**CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/164895 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

• Upgrade IBM Cloud CLI to version 0.20.0 or higher
• Upgrade the embedded CF CLI to version equal to or higher than 6.45.0. Customers can achieve that through “ibmcloud cf install -v” command.

�

Workarounds and Mitigations

None