CVE-2017-8034

The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...

CVE-2017-8034

The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...

Code injection

The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...

CVE-2017-8034

CVE-2017-8034 affects Cloud Foundry components: Cloud Controller and Router in CAPI release capi < v1.32.0, Routing-release < v0.159.0, CF-release

CVE-2017-8034

The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...

CVE-2017-8034: JWT issuer validation in multiple CF components | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected CAPI-release capi versions prior to v1.32.0 Routing-release versions prior to v0.159.0 CF-release versions prior to v267 Description The Cloud Controller and Router in Cloud Foundry do not validate the issuer on JSON Web Tokens JWTs...

Elevation of Privilege Vulnerability in Multiple Pivotal Products (CNVD-2017-15405)

Pivotal Cloud Foundry cf-release and others are products of Pivotal Software, Inc. of the U.S. Pivotal Cloud Foundry cf-release is an open-source Platform-as-a-Service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment. UAA is a...

CVE-2017-8032

In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release uaa-release 13.x versions prior to v13.17, 24.x...

Code injection

In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release uaa-release 13.x versions prior to v13.17, 24.x...

CVE-2017-8032

In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release uaa-release 13.x versions prior to v13.17, 24.x...

CVE-2017-8032

CVE-2017-8032 affects Cloud Foundry components (cf-release and UAA) where zone administrators can escalate privileges when mapping permissions for external providers. Affected versions include cf-release before v264; UAA v2.x.x; 3.6.x before 3.6.13; 3.9.x before 3.9.15; 3.20.x before 3.20.0; and ...

CVE-2017-8032

In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release uaa-release 13.x versions prior to v13.17, 24.x...

USN-3344-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3344-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.0...

Cloud Foundry BOSH Elevation of Privilege Vulnerability

Cloud Foundry BOSH is an open source toolchain for release engineering, deployment and lifecycle management of large-scale distributed services. An elevation of privilege vulnerability exists in Cloud Foundry BOSH. An attacker can exploit the vulnerability to gain elevated privileges...

Multiple Pivotal Product Session Fixation Vulnerabilities

Cloud Foundry is an open source cloud computing platform. uAA is a user authentication module, a Java Spring project. A session fixation vulnerability exists in multiple Pivotal products. An attacker could hijack arbitrary sessions and gain unauthorized access to affected applications...

USN-3302-1: ImageMagick vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could...

USN-3323-1: GNU C Library vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that the GNU C library did not properly handle memory when processing environment variables for setuid programs. A local attacker could use this in combination with another vulnerability...

USN-3311-1: libnl vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that libnl incorrectly handled memory when performing certain operations. A local attacker could possibly use this issue to cause libnl to crash, resulting in a denial of service, or...

USN-3318-1: GnuTLS vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Hubert Kario discovered that GnuTLS incorrectly handled decoding a status response TLS extension. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service...

USN-3312-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3312-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.0...