PT-2018-11363 · Cloud Foundry+1 · Garden-Runc+1

Published 2018-04-30 · Updated 2018-06-13 · CVE-2018-1277

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Garden-runC versions prior to 1.13.0

Description The issue allows a remote authenticated user to push an app with a malicious Docker image, potentially consuming more space on a Diego cell than allocated in their quota. This could cause a denial of service (DoS) against the cell. The problem arises from the incorrect enforcement of disc quotas for Docker image layers.

Recommendations For versions prior to 1.13.0, update to version 1.13.0 or later to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-1277

Affected Products

Docker

Garden-Runc

References · 3

• https://osv.dev/vulnerability/CVE-2018-1277 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2018-1277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1277 · Security Note