PT-2018-11091 · Pivotal · Concourse

Publicado 2018-03-13 · Atualizado 2019-10-03 · CVE-2018-1227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pivotal Concourse versions after 2018-03-05

Description The issue affects Pivotal Concourse, potentially allowing remote attackers to have an unspecified impact if a customer obtained the software from a DNS domain no longer controlled by Pivotal. The original domain for the Concourse CI open source project has been registered by an unknown actor and is no longer the official website. Customers who accessed the "concourse-dot-ci" domain after March 6, 2018, 18:00:00 EST, might be affected.

Recommendations For versions after 2018-03-05, immediately begin using the concourse-ci.org domain instead of "concourse-dot-ci" for downloads. Customers can also safely access Concourse software from the traditionally available locations on the Pivotal Network or GitHub.

Correção

Identificadores relacionados

CVE-2018-1227

Produtos afetados

Concourse

Referências · 3

• https://pivotal.io/security/cve-2018-1227 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1227 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1227 · Nota de Segurança