Cf-deployment vulnerabilities
3 known vulnerabilities in Cf-deployment from Cloudfoundry. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Routing Release: Inconsistent Interpretation of HTTP Requests
Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale.
- 8.1 High severity
Cloud Controller API: Improper Certificate Validation
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has z
- 9.1 Critical severity
Cloud Foundry Diego and CF Deployment: Improper Certificate Validation
Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND u