USN-3212-2: LibTIFF regression | Cloud Foundry

Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3212-1 fixed vulnerabilities in LibTIFF. Unfortunately, some of the security patches were misapplied, which caused a regression when processing certain images. This update fixes the problem. We apologize for the...

USN-3309-1: Libtasn1 vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Jakub Jirasek discovered that GnuTLS incorrectly handled certain assignments files. If a user were tricked into processing a specially crafted assignments file, a remote attacker could possibly execute...

USN-3334-1: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that the stack guard page for processes in the Linux kernel was not sufficiently large enough to prevent overlapping with the heap. An attacker could leverage this with another vulnerabili...

Pivotal Cloud Foundry and UAA Denial of Service Vulnerabilities

Pivotal Cloud Foundry PCF is a product of Pivotal Software, Inc. in the United States. pcf is an open source platform-as-a-service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment, among other features. cf-release is a release...

Pivotal Cloud Foundry and UAA Elevation of Privilege Vulnerabilities

Pivotal Cloud Foundry PCF is a product of Pivotal Software, Inc. in the United States. pcf is an open source platform-as-a-service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment, among other features. cf-release is a release...

Pivotal Cloud Foundry and UAA Password Reset Vulnerability

Pivotal Cloud Foundry PCF is a product of Pivotal Software, Inc. in the United States. pcf is an open source platform-as-a-service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment, among other features. cf-release is a release...

Pivotal Cloud Foundry and UAA SQL Injection Vulnerabilities

Pivotal Cloud Foundry PCF is a product of Pivotal Software, Inc. in the United States. pcf is an open source platform-as-a-service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment, among other features. cf-release is a release...

Pivotal Cloud Foundry and UAA Privileged Access Vulnerabilities

Pivotal Cloud Foundry PCF is a product of Pivotal Software, Inc. in the United States. pcf is an open source platform-as-a-service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment, among other features. cf-release is a release...

CVE-2017-4974

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release uaa-release 13.x versions prior to v13.13,...

CVE-2016-8218

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT...

Design/Logic Flaw

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions prior to v3.9.14, and other versions prior to v4.3.0; and UAA bosh release uaa-release 13.x versions prior to v13.16,...

Sql injection

An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. In certain cases an authenticated Director user can provide a malicious checksum that could allow them to escalate their privileges on the Director VM, aka "BOSH Director Shell...

Design/Logic Flaw

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release uaa-release 13.x versions prior to v13.12,...

Code injection

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor role is over-privileged with the ability to restage applications. This could cause application downtime if the restage fails...

Sql injection

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release uaa-release 13.x versions prior to v13.12,...

CVE-2016-8218

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT...

Session fixation

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external...

CVE-2017-4963

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external...

CVE-2017-4994

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions prior to v3.9.14, and other versions prior to v4.3.0; and UAA bosh release uaa-release 13.x versions prior to v13.16,...

CVE-2016-6655

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injection vulnerability was discovered in a common script used by many Cloud Foundry components. A malicious user may exploit numerous vectors to...