CVE-2018-1197: GCP Metadata Endpoint Accessible from Application Containers on Windows | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions Windows Stemcells All versions prior to 1200.14 Description Apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this...

CVE-2018-1221: Gorouter websocket handling vulnerability | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions cf-deployment All versions prior to 1.14.0 routing-release All versions prior to 0.172.0 Description The Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and...

USN-3506-1: rsync vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that rsync proceeds with certain file metadata updates before checking for a filename. An attacker could use this to bypass access restrictions. CVE-2017-17433 It was discovered that rsy...

Logic Flaw Vulnerability in Multiple Pivotal Products

Pivotal Cloud Foundry cf-release and others are products of Pivotal Software, Inc. of the U.S. Pivotal Cloud Foundry cf-release is an open-source Platform-as-a-Service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment. UAA is a...

CVE-2018-1192

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versio...

Code injection

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versio...

CVE-2018-1192

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versio...

CVE-2018-1192

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versio...

CVE-2018-1192

The CVE-2018-1192 issue affects Cloud Foundry components: cf-release (< v285), cf-deployment (< v1.7), UAA (< 4.5.5 in 4.5.x; < 4.8.3 in 4.8.x; < 4.7.4 in 4.7.x), and UAA-release (< 45.7, < 52.7,

USN-3538-1: OpenSSH vulnerabilities | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Jann Horn discovered that OpenSSH incorrectly loaded PKCS11 modules from untrusted directories. A remote attacker could possibly use this issue to execute arbitrary PKCS11 modules. This issue only affected...

The software vulnerabilities of Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime, a software platform of Cloud Foundry, allow attackers to exploit old sessions after password reset.

The vulnerability of the Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime software platforms is related to incorrect session expiration times. Exploiting this vulnerability allows a malicious actor to utilize an existing session after password reset, as...

USN-3534-1: GNU C Library vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that the GNU C library did not properly handle all of the possible return values from the kernel getcwd2 syscall. A local attacker could potentially exploit this to execute arbitrary code ...

The software vulnerabilities of Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime – a software platform existing due to a flaw in the forgotten password recovery mechanism – allow attackers to exploit old links to reset passwords.

The vulnerabilities of the Cloud Foundry Runtime cf-release, UAA Standalone, and Pivotal Cloud Foundry Elastic Runtime software platforms exist due to a flaw in the mechanism for recovering forgotten passwords. Exploiting these vulnerabilities allows an attacker operating remotely to use outdated...

CVE-2018-1192: UAA SessionID present in Audit Event Logs | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions All cf-release versions prior to v285 All cf-deployment versions prior to v1.7 UAA 4.5.x versions prior to 4.5.5 4.8.x versions prior to 4.8.3 4.7.x versions prior to 4.7.4 UAA-release 45.7.x versions prior...

USN-3513-1: libxml2 vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service...

USN-3532-1: GDK-PixBuf vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS...

USN-3535-1: Bind vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Jayachandran Palanisamy discovered that the Bind resolver incorrectly handled fetch cleanup sequencing. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of...

Meltdown and Spectre Attacks | Cloud Foundry

Severity Advisory/Critical Description Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a maliciou...

Pivotal Cloud Foundry and UAA elevation of privilege vulnerability (CNVD-2018-04368)

Pivotal Cloud Foundry PCF is a product of Pivotal Software, Inc. of the U.S. PCF is an open-source Platform-as-a-Service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment, among other capabilities.UAA is an authentication and...

USN-3540-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity Critical Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3540-1 addressed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubunt...