CVE-2019-17596: x509 parsing in Golang can cause panic | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Various Cloud Foundry components are written in Go and are therefore vulnerable to a denial of service attack. Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public...

CVE-2019-3781: CF CLI does not sanitize user's password in verbose/trace/debug | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions Severity is high unless otherwise noted. CF CLI All versions prior to v6.43.0 CF CLI Release All versions prior to v1.13.0 CF Networking Release All versions Prior to v2.23.0 CF Routing Release All versions...

CVE-2018-15755

CVE-2018-15755 affects Cloud Foundry CF Networking Release (versions prior to 2.16.0, specifically 2.11.0–2.15.0). The internal API endpoint between Diego cells and the policy server is vulnerable to SQL injection. A remote attacker with mTLS certificates and valid authentication can issue arbitr...

CVE-2018-15755: Improper Neutralization of Special Elements used in an SQL Command

Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...