Cloud Foundry bits service vulnerabilities

Latest Cloud Foundry bits service CVEs

Newest publication first

1. CVE-2018-15800 Timing attack allows extraction of signing key in Bits Service

   Published 2018-12-10

   Medium·CVSS 6.8 EPSS 0.93%

   Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.