PT-2018-11333 · Cloud Foundry · Cloud Foundry Loggregator

Published 2018-06-06 · Updated 2020-08-24 · CVE-2018-1269

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Loggregator versions 89.x prior to 89.5 Cloud Foundry Loggregator versions 96.x prior to 96.1 Cloud Foundry Loggregator versions 99.x prior to 99.1 Cloud Foundry Loggregator versions 101.x prior to 101.9 Cloud Foundry Loggregator versions 102.x prior to 102.2

Description The issue arises from the software's failure to handle errors thrown during the construction of certain HTTP requests. This can be exploited by a remote authenticated user who constructs malicious requests, causing the traffic controller to leave dangling TCP connections. This situation could lead to a denial of service.

Recommendations For versions 89.x prior to 89.5, update to version 89.5 or later. For versions 96.x prior to 96.1, update to version 96.1 or later. For versions 99.x prior to 99.1, update to version 99.1 or later. For versions 101.x prior to 101.9, update to version 101.9 or later. For versions 102.x prior to 102.2, update to version 102.2 or later.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2018-1269

Affected Products

Cloud Foundry Loggregator

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-1269 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1269 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2018-1269 · Note