PT-2024-28234 · Cloud Foundry · Cloud Foundry Capi Release+1

Published 2024-11-10 · Updated 2024-11-12 · CVE-2024-38826

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/RE:L

Name of the Vulnerable Software and Affected Versions Cloud Foundry Capi Release versions prior to 1.194.0 Cloud Foundry cf-deployment versions prior to v44.1.0

Description The issue allows authenticated users to upload specifically crafted files, potentially leading to a denial of service attack against Cloud Controller by leaking server resources.

Recommendations For Cloud Foundry Capi Release versions prior to 1.194.0, upgrade to version 1.194.0 or greater. For Cloud Foundry cf-deployment versions prior to v44.1.0, upgrade to version v44.1.0 or greater, which includes a patched capi release.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-38826

Affected Products

Cloud Foundry Capi Release

Cf-Deployment

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-38826 · Security Note
• https://twitter.com/VulmonFeeds/status/1855994639766921380 · Twitter Post
• https://t.me/cvedetector/10461 · Telegram Post
• https://cloudfoundry.org/blog/cve-2024-38826-cloud-controller-denial-of-service-attack · Note
• https://twitter.com/oktsec/status/1855862438597632337 · Twitter Post
• https://t.me/cvenotify/101260 · Telegram Post
• https://twitter.com/CVEnew/status/1855850816990765147 · Twitter Post