EUVD-2016-7561

Malware in sbrugna...

Design/Logic Flaw

Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL basic auth or OAuth to access the buildpack through the CLI. For example, the...

CVE-2016-6638: Credential Vulnerability for Custom Buildpacks | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to 245 Please note: this CVE was intended to be fixed in cf-release 241 but it was discovered that the fix was incomplete, which was assigned CVE-2016-6658. Description Applications can be configured and...