PT-2019-12231 · Cloud Foundry · Cloud Foundry Routing

Published 2019-11-19 · Updated 2021-07-28 · CVE-2019-11289

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing versions prior to 0.193.0

Description The issue arises from improper input validation, allowing a maliciously crafted input to cause a panic due to incorrect nonce size. This can be used as a vector for a denial of service attack, where a remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce, causing the Gorouter to crash.

Recommendations For versions prior to 0.193.0, update to version 0.193.0 or later to resolve the issue. As a temporary workaround, consider implementing proper input validation to prevent the use of invalid nonces, which could help minimize the risk of exploitation. Restrict access to the Gorouter to minimize the risk of denial of service attacks until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-11289

GHSA-5796-P3M6-9QJ4

GO-2021-0102

Affected Products

Cloud Foundry Routing

References · 8

• https://osv.dev/vulnerability/CVE-2019-11289 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0102 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5796-p3m6-9qj4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11289 · Security Note
• https://cloudfoundry.org/blog/cve-2019-11289 · Vendor Advisory
• https://github.com/cloudfoundry/gorouter · Note
• https://github.com/cloudfoundry/gorouter/commit/b1b5c44e050f73b399b379ca63a42a2c5780a83f · Note
• https://pkg.go.dev/vuln/GO-2021-0102 · Note