PT-2023-17686 · Unknown · Cloud Foundry

Geoff Franks · Publicado 2023-05-26 · Atualizado 2025-01-16 · CVE-2023-20882

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry routing release versions 0.262.0 through 0.266.0

Description A bug in the gorouter process can cause a denial of service for applications hosted on Cloud Foundry. This occurs when client connections are closed prematurely, leading to the gorouter marking the currently selected backend as failed and removing it from the routing pool.

Recommendations For versions 0.262.0 through 0.266.0, update to a version later than 0.266.0 to resolve the issue. As a temporary workaround, consider implementing measures to prevent premature client connection closures to minimize the risk of exploitation.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-20882

Produtos afetados

Cloud Foundry

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-20882 · Nota de Segurança
• https://cloudfoundry.org/blog/cve-2023-20882-gorouter-pruning-via-client-disconnect-resulting-in-dos · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-20882 · Aviso do Fabricante