Pivotal Software Cloud Foundry cf-release and CAPI-release information disclosure vulnerabilities

Pivotal Software Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other capabilities. cf-release and...

CVE-2017-8035: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud...

Pivotal Software Cloud Foundry cf-release and CAPI-release path traversal vulnerabilities

Pivotal Software Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other capabilities. cf-release and...

Design/Logic Flaw

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

CVE-2017-8036

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

CVE-2017-8036

CVE-2017-8036 affects Cloud Foundry Foundation Cloud Controller API via a regression introduced by the fix for CVE-2017-8033 in CAPI-release 1.33.0 (only). A space developer can push a crafted app to execute arbitrary code on the Cloud Controller VM. The issue, tied to the same regression path as...

CVE-2017-8036

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

CVE-2017-8036: Undefined Security Weakness

An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 only. The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushin...

PT-2017-18081

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation CAPI-release version 1.33.0 Description An issue in the Cloud Controller API allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. This issue is a...

CVE-2017-8036: Cloud Controller API regression | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Versions Affected CAPI-release version 1.33.0 only Description The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing...

CVE-2017-8034

The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...

CVE-2017-8034

CVE-2017-8034 affects Cloud Foundry components: Cloud Controller and Router in CAPI release capi < v1.32.0, Routing-release < v0.159.0, CF-release

CVE-2017-8034: JWT issuer validation in multiple CF components | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected CAPI-release capi versions prior to v1.32.0 Routing-release versions prior to v0.159.0 CF-release versions prior to v267 Description The Cloud Controller and Router in Cloud Foundry do not validate the issuer on JSON Web Tokens JWTs...

CVE-2016-8219

The CVE affects Cloud Foundry Foundation cf-release before 250 and CAPI-release before 1.12.0. The vulnerability arises because a SpaceAuditor can restage applications, enabling over-privileged actions that could cause application downtime if restaging fails. Mitigation is to upgrade cf-release t...

CVE-2016-8219: Improper Privilege Management

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor role is over-privileged with the ability to restage applications. This could cause application downtime if the restage fails...

PT-2017-9538

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation cf-release versions prior to 250 Cloud Foundry Foundation CAPI-release versions prior to 1.12.0 Description An issue was discovered where a user with the SpaceAuditor role has excessive privileges, allowing them to...

Multiple Cloud Foundry Product Information Disclosure Vulnerabilities

Pivotal Cloud Foundry PCF is an open source Platform as a Service PaaS cloud computing platform from Pivotal Software, USA. An information disclosure vulnerability exists in versions prior to cf-release 250 and versions prior to CAPI-release 1.12.0. An attacker could exploit this vulnerability to...

CVE-2016-9882

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. These logs are written to disk and often sent to a log...

CVE-2016-9882

CVE-2016-9882 affects Cloud Foundry cf-release before v250 and CAPI-release before v1.12.0. The issue is that Cloud Foundry logs credentials returned from service brokers in Cloud Controller system component logs; these logs are written to disk and often forwarded to log aggregators via syslog. T...

CVE-2016-9882: Insertion of Sensitive Information into Log File

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. These logs are written to disk and often sent to a log...