CVE-2016-6658 Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a cre...
CriticalCVSS 9.6
EPSS 0.87%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth) to access the buildpack through the CLI. For example, the user could include a GitHub username and password in the URL to access a private repo. Because the URL to access the buildpack is stored unencrypted, an operator with privileged access to the Cloud Controller database could view these credentials.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-release | < 245 | 245 |
| pivotal software cloud foundry elastic runtime | < 1.6.49 | 1.6.49 |
| pivotal software cloud foundry elastic runtime | >= 1.7.0, < 1.7.31 | 1.7.31 |
| pivotal software cloud foundry elastic runtime | >= 1.8.0, < 1.8.11 | 1.8.11 |
References
- pivotal.io vendor-advisory