PT-2023-17686 · Unknown · Cloud Foundry

Geoff Franks · Published 2023-05-26 · Updated 2025-01-16 · CVE-2023-20882

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry routing release versions 0.262.0 through 0.266.0

Description A bug in the gorouter process can cause a denial of service for applications hosted on Cloud Foundry. This occurs when client connections are closed prematurely, leading to the gorouter marking the currently selected backend as failed and removing it from the routing pool.

Recommendations For versions 0.262.0 through 0.266.0, update to a version later than 0.266.0 to resolve the issue. As a temporary workaround, consider implementing measures to prevent premature client connection closures to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-20882

Affected Products

Cloud Foundry

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-20882 · Security Note
• https://cloudfoundry.org/blog/cve-2023-20882-gorouter-pruning-via-client-disconnect-resulting-in-dos · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20882 · Vendor Advisory