PT-2019-16729 · Cloud Foundry · Cf-Deployment

Published 2019-04-25 · Updated 2021-10-29 · CVE-2019-3801

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry cf-deployment versions prior to 7.9.0

Description The issue concerns the use of an insecure protocol by java components in Cloud Foundry cf-deployment to fetch dependencies during the building process. This could allow a remote unauthenticated malicious attacker to hijack the DNS entry for the dependency and inject malicious code into the component.

Recommendations For versions prior to 7.9.0, update to version 7.9.0 or later to resolve the issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-494

CWE-319

Related Identifiers

CVE-2019-3801

Affected Products

Cf-Deployment

References · 4

• https://cloudfoundry.org/blog/cve-2019-3801 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3801 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3801 · Vendor Advisory
• http://securityfocus.com/bid/108104 · Note