PT-2017-16233 · Cloud Foundry Foundation · Cf-Release+1

Publicado 2017-06-13 · Atualizado 2019-10-03 · CVE-2017-4970

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation cf-release version 255 Staticfile buildpack versions 1.4.0 through 1.4.3

Description An issue was discovered that causes the Staticfile.auth configuration to be ignored when the Static file is not present in the application root. This affects applications containing a Staticfile.auth file but not a Static file, resulting in basic auth being turned off when the Static file build pack is upgraded to a vulnerable version.

Recommendations For Cloud Foundry Foundation cf-release version 255, update the configuration to ensure proper detection of Staticfile.auth. For Staticfile buildpack versions 1.4.0 through 1.4.3, consider explicitly specifying the Static file build pack to prevent misconfiguration. As a temporary workaround, consider verifying the presence of the Static file in the application root to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2017-4970

Produtos afetados

Staticfile Buildpack

Cf-Release

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-4970 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-4970 · Aviso do Fabricante
• https://cloudfoundry.org/cve-2017-4970 · Aviso do Fabricante