CVE-2023-20882

CVE-2023-20882 affects Cloud Foundry gorouter in routing releases 0.262.0 through 0.266.0. A bug triggered by premature client connection closures can cause the gorouter to mark the currently selected backend as failed and remove it from the routing pool, potentially leading to denial of service ...

CVE-2023-20882

In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected...

Cloud Foundry Routing Release Denial of Service Vulnerability

Cloud Foundry is a set of open source Platform as a Service PaaS cloud computing platforms from the Cloud Foundry Foundation in the United States. The product provides container scheduling, continuous delivery and automated service deployment and other functions. routing is one of the routing...

CVE-2020-5401

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

CVE-2020-5401

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

Null pointer dereference

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

CVE-2020-5401

CVE-2020-5401 affects Cloud Foundry Routing Release (prior to 0.197.0) which includes GoRouter. Malicious clients can send invalid headers, causing caching layers to reject subsequent legitimate clients. The vulnerability, described in multiple sources, results in degraded access for users to app...

CVE-2020-5401: Cloud Foundry GoRouter is vulnerable to cache poisoning | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Description Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app. Affected Cloud...

CVE-2019-3789

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that...

Design/Logic Flaw

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that...

CVE-2019-3789 Gorouter allows space developer to hijack route services hosted outside the platform

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that...

CVE-2019-3789

CVE-2019-3789 affects Cloud Foundry Routing Release (CF Routing) prior to 0.188.0. A space developer can create a private domain shadowing an external route service domain and map it to an app, causing the gorouter to route external traffic to the internal app instead. Impact is hijacking of rout...

Cloud Foundry routing-release security bypass vulnerability

Cloud Foundry is a set of open source Platform-as-a-Service PaaS cloud computing platform from the Cloud Foundry Foundation in the United States, which provides container scheduling, continuous delivery, and automated service deployment. routing-release is one of the components that provides HTTP...

CVE-2018-1193

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections...

Authentication flaw

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections...

CVE-2018-1193

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections...

CVE-2018-1193

Cloud Foundry routing-release before version 0.175.0 fails to sanitize user-provided X-Forwarded-Proto headers, allowing a remote attacker to bypass application requirements that enforce secure connections. Root cause: lack of filtering on X-Forwarded-Proto in routing-release/gorouter. Impact: po...

CVE-2018-1193

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections...

Pivotal Cloud Foundry cf-deployment and routing-release denial of service vulnerabilities

Pivotal Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other things. cf-deployment is its development...

Open redirect

In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain...