CVE-2016-6658

Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL basic auth or OAuth to access the buildpack through the CLI. For example, the...

PT-2018-4966

Name of the Vulnerable Software and Affected Versions cf-release versions prior to 245 Description The issue allows an operator with privileged access to the Cloud Controller database to view user-provided credentials, such as basic auth or OAuth, used to access custom buildpacks. These credentia...

CVE-2016-6658: Exposure of Sensitive Information to an Unauthorized Actor

Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL basic auth or OAuth to access the buildpack through the CLI. For example, the...