PT-2020-18457 · Cloud Foundry · Cloud Foundry Routing Release

Nathan Davison · Published 2020-02-27 · Updated 2020-03-03 · CVE-2020-5401

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing Release versions prior to 0.197.0

Description The issue allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app. This is a cache poisoning denial-of-service (DoS) issue.

Recommendations For versions prior to 0.197.0, update to version 0.197.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the caching layers to minimize the risk of exploitation.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

CWE-393

Related Identifiers

CVE-2020-5401

Affected Products

Cloud Foundry Routing Release

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-5401 · Security Note
• https://cloudfoundry.org/blog/cve-2020-5401 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5401 · Vendor Advisory
• https://t.me/malwr/2544 · Telegram Post
• https://t.me/secharvester/8618 · Telegram Post
• https://t.me/defcon_news/39959 · Telegram Post
• https://t.me/rnetsec/11684 · Telegram Post