Pivotal Cloud Foundry cf-deployment and routing-release denial of service vulnerabilities

Pivotal Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other things. cf-deployment is its development...

Cloud Foundry Windows Stemcells Information Disclosure Vulnerability

Cloud Foundry Windows Stemcells are a set of specially crafted operating system images that contain the file systems of BOSH-managed virtual machines. A security vulnerability exists in Cloud Foundry Windows Stemcells versions prior to 1200.14. An attacker could exploit the vulnerability to obtai...

File Traversal

github.com/cloudfoundry-attic/garden-linux is vulnerable to file traversal attacks. The garden-linux nstar executable allows attackers to read files within the host system that the BOSH-created vcap user has permission to read. This can be done by staging an application on Cloud Foundry using Die...

Pivotal Application Service Apps Manager for PCF Information Disclosure Vulnerability

Pivotal Application Service is a suite of application management software from Pivotal Software, U.S.A. Apps Manager for PCF is one of the application managers for PCF. \ A security vulnerability exists in Apps Manager for PCF in Pivotal Application Service versions 1.11.x before 1.11.26, 1.12.x...

CVE-2018-1221

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

Design/Logic Flaw

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

CVE-2018-1221

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

CVE-2018-1221

In CVE-2018-1221, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and other HTTP-aware Load Balancers. Affected products are cf-deployment (all versions before 1.14.0) and routing-release (all versions before 0.172.0). The underlying root cause i...

CVE-2018-1221

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

Code injection

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...

CVE-2015-5350

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...

CVE-2015-5350

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...

CVE-2015-5350

CVE-2015-5350 affects Garden Linux via the garden-linux nstar executable in Garden versions 0.22.0–0.329.0. An attacker staging an application on Cloud Foundry (Diego and Garden) with a malicious custom buildpack could read host-system files that the vcap user can read and package them into the a...

PT-2018-10918 · Cloud Foundry · Cf-Release +2

Name of the Vulnerable Software and Affected Versions: Cloud Controller versions prior to 1.46.0 cf-deployment versions prior to 1.3.0 cf-release versions prior to 283 Description: The issue allows refresh tokens to be used for authentication where access tokens are expected. This exposes a...

CVE-2015-5350: Improper Access Control

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...

CVE-2018-1221: Improper Input Validation

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

PT-2018-11056

Name of the Vulnerable Software and Affected Versions Cloud Foundry cf-deployment versions prior to 1.14.0 Cloud Foundry routing-release versions prior to 0.172.0 Description The Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware...

PT-2018-4400

Name of the Vulnerable Software and Affected Versions Garden versions 0.22.0 through 0.329.0 Description A vulnerability has been discovered in the garden-linux nstar executable of Garden, allowing access to files on the host system. This issue can be exploited by staging an application on Cloud...

CVE-2016-9880

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2018-1200

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...