CVE-2018-1265

2018-06-0620:29:00

Google

osv.dev

7.2 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

JSON

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell.

CPENameOperatorVersion
cf-deploymenteq0.1385.0
cf-deploymenteq1.15.1
cf-deploymenteq0.23.0
cf-deploymenteq0.1461.0
cf-deploymenteq0.1302.0
cf-deploymenteq0.1338.0
cf-deploymenteq0.1022.0
cf-deploymenteq0.1234.0
cf-deploymenteq0.0.2
cf-deploymenteq0.1355.0

Name	Operator	Version
cf-deployment	eq	0.1385.0
cf-deployment	eq	1.15.1
cf-deployment	eq	0.23.0
cf-deployment	eq	0.1461.0
cf-deployment	eq	0.1302.0
cf-deployment	eq	0.1338.0
cf-deployment	eq	0.1022.0
cf-deployment	eq	0.1234.0
cf-deployment	eq	0.0.2
cf-deployment	eq	0.1355.0