PT-2017-8651 · Pivotal · Pivotal Cloud Foundry+2

Publicado 2017-04-24 · Atualizado 2022-05-14 · CVE-2016-5016

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry versions 239 and earlier UAA versions 3.4.1 and earlier UAA release 12.2 and earlier PCF Elastic Runtime versions 1.6.x before 1.6.35 PCF Elastic Runtime versions 1.7.x before 1.7.13

Description The issue is related to the failure to validate if a certificate is expired.

Recommendations For Pivotal Cloud Foundry versions 239 and earlier, update to a version later than 239. For UAA versions 3.4.1 and earlier, update to a version later than 3.4.1. For UAA release 12.2 and earlier, update to a release later than 12.2. For PCF Elastic Runtime versions 1.6.x before 1.6.35, update to version 1.6.35 or later. For PCF Elastic Runtime versions 1.7.x before 1.7.13, update to version 1.7.13 or later.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2016-5016

GHSA-RC2R-W8JV-VGGP

Produtos afetados

Pcf Elastic Runtime

Pivotal Cloud Foundry

Uaa

Referências · 14

• https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3 · Nota
• https://github.com/cloudfoundry/uaa/releases/tag/3.4.2 · Nota
• https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6 · Nota
• https://github.com/cloudfoundry/uaa/commit/0a78612f981c541ad2d997e6a365f2a0b3e799d9 · Nota
• https://github.com/cloudfoundry/uaa/commit/f97049df1c6c03effda5049c41704ac831ff3925 · Nota
• https://github.com/cloudfoundry/uaa/commit/bc91ccd2029e8f1cea0c647f0c9aad4585f7a2c · Nota
• https://github.com/cloudfoundry/cf-release/releases/tag/v240 · Nota
• https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3 · Nota
• https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5016 · Nota
• https://pivotal.io/security/cve-2016-5016 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5016 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-5016 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rc2r-w8jv-vggp · Aviso do Fabricante