CVE-2017-4963

CVE-2017-4963 affects Cloud Foundry Foundation Cloud Foundry release v252 and earlier, UAA stand-alone releases v2.0.0–v2.7.4.12 and v3.0.0–v3.11.0, and UAA bosh release v26 and earlier. The issue is a session fixation vulnerability when UAA is configured to authenticate against external SAML or ...

CVE-2017-4992

CVE-2017-4992 affects Cloud Foundry components including cf-release prior to v261 and UAA releases prior to specified versions (2.x before 2.7.4.17, 3.6.x before 3.6.11, 3.9.x before 3.9.13, and other versions before v4.2.0; UAA bosh releases prior to 13.x before 13.15, 24.x before 24.10, 30.x be...

CVE-2016-6655

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injection vulnerability was discovered in a common script used by many Cloud Foundry components. A malicious user may exploit numerous vectors to...

CVE-2017-4970

CVE-2017-4970 describes a regression in the Cloud Foundry cf-release v255 and Staticfile buildpack v1.4.0–v1.4.3. The Staticfile buildpack regression causes the Staticfile.auth configuration to be ignored when the Staticfile is not present in the application root; apps that contain a Staticfile.a...

CVE-2017-4974

CVE-2017-4974 is a blind SQL injection vulnerability affecting Cloud Foundry Foundation components: cf-release versions prior to v258 and UAA releases prior to v2.7.4.15 (2.x), v3.6.9 (3.6.x), v3.9.11 (3.9.x), and prior to v3.16.0 in general, plus uaa-release bosh releases prior to v13.13, v24.8,...

CVE-2017-4994

CVE-2017-4994 affects Cloud Foundry components including cf-release prior to v263 and UAA releases earlier than v2.7.4.18 (2.x), v3.6.12 (3.6.x), v3.9.14 (3.9.x), and v4.3.0+ for other lines, plus UAA Bosh releases prior to v13.16, v24.11, and v30.4. The issue is with forwarded HTTP headers in UA...

CVE-2017-4991

CVE-2017-4991 affects Cloud Foundry products: cf-release versions before v260 and multiple UAA releases (2.x before v2.7.4.16; 3.6.x before v3.6.10; 3.9.x before v3.9.12; others before v3.17.0) plus UAA-bosh releases (uaa-release) before v13.14, v24.9, v30.2, and earlier versions before v36. The ...

CVE-2016-8218

CVE-2016-8218 affects Cloud Foundry’s routing-release (versions prior to 0.142.0) and cf-release (203–231). The issue is incomplete validation in JSON Web Token (JWT) libraries, enabling unprivileged attackers to impersonate other users to the routing API. Remediation: upgrade routing-release to ...

CVE-2017-4959

An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x versions prior to 1.8.29 and 1.9.x versions prior to 1.9.7. Pivotal Cloud Foundry deployments using the Pivotal Account application are vulnerable to a flaw which allows an authorized user to take over the account of another user, causi...

CVE-2016-6655

CVE-2016-6655 affects Cloud Foundry Foundation Cloud Foundry releases prior to v245 and cf-mysql-release prior to v31. A command injection vulnerability exists in a common script used by many Cloud Foundry components, enabling a malicious user to execute arbitrary commands on affected servers. Th...

CVE-2017-4973

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release uaa-release 13.x versions prior to v13.12,...

PT-2017-4084 · Pivotal +1 · Rabbitmq +1

Name of the Vulnerable Software and Affected Versions: RabbitMQ versions 3.4.x through 3.5.x RabbitMQ versions 3.6.x prior to 3.6.9 RabbitMQ for PCF versions 1.5.x RabbitMQ for PCF versions 1.6.x prior to 1.6.18 RabbitMQ for PCF versions 1.7.x prior to 1.7.15 Description: The issue is related to...

CVE-2017-8032: UAA Identity Zone Admin Privilege Escalation | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected Please see additional information in the Mitigation section to determine if your foundation is affected. cf-release versions prior to v264 UAA release: All versions of UAA v2.x.x 3.6.x versions prior to v3.6.13 3.9.x versions prior t...

USN-3304-1: Sudo vulnerability | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that Sudo did not properly parse the contents of /proc/pid/stat when attempting to determine its controlling tty. A local attacker in some configurations could possibly use this to overwri...

CVE-2016-3091

Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service...

Denial of service

Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service...

CVE-2016-3091

Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service...

CVE-2016-3091

CVE-2016-3091 affects Cloud Foundry Diego component; Diego releases 0.1468.0–0.1470.0 are vulnerable to denial-of-service due to log handling that splits large UTF-8 log streams, exploitable by an app emitting malformed UTF-8. Remediation: upgrade to Diego 0.1471.0.

CVE-2016-3091

Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service...

CVE-2017-4994: Forwarded Headers in UAA | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v263 UAA release: 2.x versions prior to v2.7.4.18 3.6.x versions prior to v3.6.12 3.9.x versions prior to v3.9.14 Other versions prior to v4.3.0 UAA bosh release uaa-release: 13.x versions prior to v13.16...