CVE-2018-15754

Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a tok...

Authorization

Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a tok...

CVE-2018-15754

Cloud Foundry UAA (versions 60.x prior to 66.0) contains an authorization logic error that can allow a remote authenticated user to obtain a token for another account with the same username across different identity providers. This vulnerability is triggered in environments with multiple identity...

PT-2018-13182

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 66.0 Description The issue concerns an authorization logic error in environments with multiple identity providers where accounts have the same username across different providers. A remote authenticated user...

CVE-2018-15754: Incorrect Authorization

Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a tok...

USN-3843-1: pixman vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that pixman incorrectly handled the generalcompositerect function. A remote attacker could use this issue to cause pixman to crash, resulting in a denial of service, or possibly execute...

Cloud Foundry Bits Service Information Disclosure Vulnerability

Cloud Foundry Bits Service is a program from the Cloud Foundry Foundation that encapsulates "bit manipulation" into a separately scalable service. An information disclosure vulnerability exists in Cloud Foundry Bits Service versions prior to 2.18.0, which can be exploited by a remote attacker to...

CVE-2018-15800

Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage...

CVE-2018-15800

Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage...

Information disclosure

Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage...

UBUNTU-CVE-2018-1279

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...

CVE-2018-15800 Timing attack allows extraction of signing key in Bits Service

Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage...

CVE-2018-15800

CVE-2018-15800 affects Cloud Foundry Bits Service prior to version 2.18.0. The vulnerability is an information disclosure where a remote attacker can perform a timing attack to brute-force the signing key, yielding complete read and write access to the Bits Service storage. The root cause is a ti...

CVE-2018-15800: Exposure of Sensitive Information to an Unauthorized Actor

Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage...

USN-3839-1: WavPack vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-19840, CVE-2018-19841 CVEs contained in this USN...

CVE-2018-15754: UAA issues tokens across identity providers if users with matching usernames exist | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions UAA release: versions v60 prior to v66.0 Description Cloud Foundry UAA, versions v60 prior to v66.0, contain an authorization logic error. In environments with multiple identity providers that contain...

CVE-2018-15754: UAA issues tokens across identity providers if users with matching usernames exist | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions UAA all versions in v60.x, v61.x, v62.x, v63.x, v64.x Description Cloud Foundry UAA, all versions in v60.x, v61.x, v62.x, v63.x, and v64.x contain an authorization logic error. In environments with multip...

PT-2018-13215

Name of the Vulnerable Software and Affected Versions Cloud Foundry Bits Service versions prior to 2.18.0 Description The issue allows a remote malicious user to execute a timing attack, potentially brute-forcing the signing key. This could grant the attacker complete read and write access to the...

USN-3816-2: systemd vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description USN-3816-1 fixed several vulnerabilities in systemd. However, the fix for CVE-2018-6954 was not sufficient. This update provides the remaining fixes. We apologize for the...

USN-3816-3: systemd regression | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-3816-1 fixed vulnerabilities in systemd. The fix for CVE-2018-6954 caused a regression in systemd-tmpfiles when running Ubuntu inside a container on some older kernels. This issue only affected Ubuntu...