PT-2019-12231 · Cloud Foundry · Cloud Foundry Routing

Publicado 2019-11-19 · Atualizado 2021-07-28 · CVE-2019-11289

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing versions prior to 0.193.0

Description The issue arises from improper input validation, allowing a maliciously crafted input to cause a panic due to incorrect nonce size. This can be used as a vector for a denial of service attack, where a remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce, causing the Gorouter to crash.

Recommendations For versions prior to 0.193.0, update to version 0.193.0 or later to resolve the issue. As a temporary workaround, consider implementing proper input validation to prevent the use of invalid nonces, which could help minimize the risk of exploitation. Restrict access to the Gorouter to minimize the risk of denial of service attacks until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-11289

GHSA-5796-P3M6-9QJ4

GO-2021-0102

Produtos afetados

Cloud Foundry Routing

Referências · 8

• https://github.com/cloudfoundry/gorouter · Nota
• https://github.com/cloudfoundry/gorouter/commit/b1b5c44e050f73b399b379ca63a42a2c5780a83f · Nota
• https://osv.dev/vulnerability/CVE-2019-11289 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2021-0102 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5796-p3m6-9qj4 · Aviso do Fabricante
• https://pkg.go.dev/vuln/GO-2021-0102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11289 · Nota de Segurança
• https://cloudfoundry.org/blog/cve-2019-11289 · Aviso do Fabricante