CVE-2018-1264

The CVE concerns Cloud Foundry Log Cache prior to version 1.1.1, where the UAA client secret is logged on startup as part of the envstruct report. This exposes the secret to an attacker with access to the Log Cache VM, potentially granting all privileges of the Log Cache UAA client and, in worst ...

CVE-2018-1264 Log Cache logs UAA client secret on startup

Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is ...

CVE-2018-11083

Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access...

CVE-2018-11082

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user...

CVE-2018-11082: Improper Restriction of Excessive Authentication Attempts

Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user...

CVE-2018-11083: Undefined Security Weakness

Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access...

CVE-2018-1264: Insertion of Sensitive Information into Log File

Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is ...

PT-2018-11301

Name of the Vulnerable Software and Affected Versions Cloud Foundry Log Cache versions prior to 1.1.1 Description The issue allows a remote attacker who has gained access to the Log Cache VM to read the UAA client secret, which is logged on startup as part of its envstruct report. This could gran...

PT-2018-10295

Name of the Vulnerable Software and Affected Versions Cloud Foundry BOSH versions v264 prior to v264.14.0 Cloud Foundry BOSH versions v265 prior to v265.7.0 Cloud Foundry BOSH versions v266 prior to v266.8.0 Cloud Foundry BOSH versions v267 prior to v267.2.0 Description The issue allows refresh...

PT-2018-10294

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 4.20.0 Cloud Foundry UAA Release versions prior to 61.0 Description The issue allows a remote unauthenticated malicious user with a valid username and password to brute force Multi-Factor Authentication MFA...

CVE-2018-11083: BOSH accepts refresh token as access token | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using bosh-release versions prior to: v264 prior to v264.14.0 v265 prior to v265.7.0 v266 prior to v266.8.0 v267 prior to v267.2.0 Description BOSH allows refresh tokens to be used as access tokens...

USN-3776-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3776-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04...

CVE-2018-15755: - CF networking internal policy server SQL injection | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using cf-networking-release versions prior to 2.16.0 Description Cloud Foundry CF-Networking, versions 2.11.0 through 2.15.0, contain an internal api endpoint vulnerable to SQL injection between...

CVE-2018-11082: UAA MFA doesn't prevent brute force of MFA code | Cloud Foundry

Severity medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using uaa-release versions prior to 61.0 You are using uaa versions prior to 4.20.0 Description UAA, versions prior to 4.20.0, allows brute forcing of MFA codes. A remote unauthenticated malicious...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affects Liberty for Java for IBM Cloud July 2018 CPU

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in July 2018. These may affect some configurations of IBM WebSphere Application Server...

CVE-2018-1264: Log Cache logs UAA client secret on startup | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using log-cache-release versions prior to 1.1.1 Description Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote...

USN-3758-1: libx11 vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 18.04 Description Tobias Stoeckmann discovered that libx11 incorrectly handled certain images. An attacker could possibly use this issue to access sensitive information CVE-2016-7942 Tobias Stoeckman...

USN-3759-1: libtirpc vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Aldy Hernandez discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue...

USN-3767-1: GLib vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that GLib incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary cod...

USN-3765-1: curl vulnerability | Cloud Foundry

Severity Medium Vendo Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that curl incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. CVEs contained in this USN...