PT-2018-4966 · Cloud Foundry · Cf-Release

Published 2018-03-29 · Updated 2018-04-24 · CVE-2016-6658

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions cf-release versions prior to 245

Description The issue allows an operator with privileged access to the Cloud Controller database to view user-provided credentials, such as basic auth or OAuth, used to access custom buildpacks. These credentials can be included in the URL to access the buildpack and are stored unencrypted. For example, a GitHub username and password used to access a private repository could be exposed.

Recommendations For versions prior to 245, consider removing or restricting access to custom buildpacks that use user-provided credentials until a fixed version is available. As a temporary workaround, avoid using credentials in the URL to access buildpacks, and instead, explore alternative authentication methods that do not involve storing sensitive information in plain text.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-6658

Affected Products

Cf-Release

References · 4

• https://pivotal.io/security/cve-2016-6658 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6658 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6658 · Note