AZL-54473 CVE-2024-45338 affecting package cf-cli for versions less than 8.7.3-5

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-24786 affecting package cf-cli for versions less than 8.4.0-22

CVE-2024-24786 affecting package cf-cli for versions less than 8.4.0-22. A patched version of the package is available...

CVE-2024-24786 affecting package cf-cli for versions less than 8.7.3-3

CVE-2024-24786 affecting package cf-cli for versions less than 8.7.3-3. A patched version of the package is available...

AZL-52251 CVE-2024-51744 affecting package cf-cli for versions less than 8.4.0-24

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

CVE-2023-39325 affecting package cf-cli for versions less than 8.7.3-2

CVE-2023-39325 affecting package cf-cli for versions less than 8.7.3-2. A patched version of the package is available...

CBL Mariner 2.0 Security Update: cf-cli / cri-o / gh / libcontainers-common (CVE-2021-43565)

The version of cf-cli / cri-o / gh / libcontainers-common installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43565 advisory. - The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of...

CVE-2021-43565 affecting package cf-cli for versions less than 8.4.0-18

CVE-2021-43565 affecting package cf-cli for versions less than 8.4.0-18. A patched version of the package is available...

AZL-38302 CVE-2023-45288 affecting package cf-cli for versions less than 8.7.3-6

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-35558 CVE-2024-24786 affecting package cf-cli for versions less than 8.4.0-22

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35636 CVE-2024-24786 affecting package cf-cli for versions less than 8.7.3-3

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2021-44716 affecting package cf-cli for versions less than 8.4.0-16

CVE-2021-44716 affecting package cf-cli for versions less than 8.4.0-16. A patched version of the package is available...

AZL-34589 CVE-2023-48795 affecting package cf-cli for versions less than 8.7.11-1

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

CVE-2023-44487 affecting package cf-cli for versions less than 8.4.0-13

CVE-2023-44487 affecting package cf-cli for versions less than 8.4.0-13. A patched version of the package is available...

AZL-34590 CVE-2023-39325 affecting package cf-cli for versions less than 8.7.3-2

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

org.eclipse.californium:californium-osgi (>=3.0.0, <=3.5.0), org.eclipse.californium:californium-proxy2 (>=3.0.0, <=3.5.0) +13 more potentially affected by CVE-2022-2576 via org.eclipse.californium:californium-core (>=3.0.0, <=3.5.0)

org.eclipse.californium:californium-core MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.0-m6, =2.0.0-m6, =2.0.0-m6, =2.0.0-m6, =2.0.0-m6, =2.0.0-m6, =2.0.0-m6, =2.0.0-m6, =2.0.0-m6, =2.0.0-m7 Source cves: CVE-2022-2576 Source advisory: OSV:GHSA-QQ3J-44GW-CF6R...

AZL-33571 CVE-2021-44716 affecting package cf-cli for versions less than 8.4.0-16

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

SUSE: Security Advisory (SUSE-SU-2019:1220-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2019:1220-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Vulnerability of Embedded CF CLI In IBM Cloud CLI

Summary Default embedded CF CLI in IBM Cloud CLI version prior to 0.20.0 contains a security vulnerability which might expose customer credentials. Vulnerability Details CVEID: CVE-2019-3800 DESCRIPTION: CF CLI version prior to v6.45.0 bosh release version 1.16.0 writes the client id and secret t...

CVE-2019-17596: x509 parsing in Golang can cause panic | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Various Cloud Foundry components are written in Go and are therefore vulnerable to a denial of service attack. Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public...