PT-2020-18474 · Cloud Controller · Capi

Published 2020-12-02 · Updated 2020-12-04 · CVE-2020-5423

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CAPI (Cloud Controller) versions prior to 1.101.0

Description The issue allows an unauthenticated malicious attacker to send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM, resulting in a denial-of-service attack.

Recommendations For versions prior to 1.101.0, update to version 1.101.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the YAML parser or limiting the size and complexity of YAML files that can be processed to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-5423

Affected Products

Capi

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-5423 · Security Note
• https://cloudfoundry.org/blog/cve-2020-5423 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5423 · Vendor Advisory
• https://t.me/cvenotify/6435 · Telegram Post