PT-2020-18468 · Cloud Foundry+1 · Cloud Foundry Routing+1

Published 2020-08-21 · Updated 2021-06-07 · CVE-2020-5416

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing (Gorouter) versions prior to 0.204.0

Description The issue allows an unauthenticated malicious attacker to send specially-crafted HTTP requests, potentially causing the Gorouters to be dropped from the NGINX backend pool, leading to denial-of-service attacks. This occurs when Cloud Foundry Routing (Gorouter) is used in a deployment with NGINX reverse proxies in front of the Gorouters.

Recommendations For Cloud Foundry Routing (Gorouter) versions prior to 0.204.0, update to version 0.204.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Gorouter when used with NGINX reverse proxies to minimize the risk of exploitation.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2020-5416

Affected Products

Cloud Foundry Routing

Nginx

References · 4

• https://cloudfoundry.org/blog/cve-2020-5416 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5416 · Security Note
• https://t.me/cvenotify/15734 · Telegram Post