PT-2019-16729 · Cloud Foundry · Cf-Deployment

Publicado 2019-04-25 · Atualizado 2021-10-29 · CVE-2019-3801

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry cf-deployment versions prior to 7.9.0

Description The issue concerns the use of an insecure protocol by java components in Cloud Foundry cf-deployment to fetch dependencies during the building process. This could allow a remote unauthenticated malicious attacker to hijack the DNS entry for the dependency and inject malicious code into the component.

Recommendations For versions prior to 7.9.0, update to version 7.9.0 or later to resolve the issue.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-494

CWE-319

Identificadores relacionados

CVE-2019-3801

Produtos afetados

Cf-Deployment

Referências · 4

• https://cloudfoundry.org/blog/cve-2019-3801 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3801 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3801 · Aviso do Fabricante
• http://securityfocus.com/bid/108104 · Nota