Vulnerabilites related to cloudfoundry - gorouter
cve-2020-5420
Vulnerability from cvelistv5
Published
2020-09-03 01:10
Modified
2024-09-17 02:06
Severity ?
EPSS score ?
Summary
Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters.
References
▼ | URL | Tags |
---|---|---|
https://www.cloudfoundry.org/blog/cve-2020-5420 | x_refsource_CONFIRM |
Impacted products
Vendor | Product | Version | |||||||
---|---|---|---|---|---|---|---|---|---|
▼ | Cloud Foundry | Routing |
Version: All < 0.206.0 |
||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T08:30:24.367Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.cloudfoundry.org/blog/cve-2020-5420" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Routing", "vendor": "Cloud Foundry", "versions": [ { "lessThan": "0.206.0", "status": "affected", "version": "All", "versionType": "custom" } ] }, { "product": "CF Deployment", "vendor": "Cloud Foundry", "versions": [ { "lessThan": "13.15.0", "status": "affected", "version": "All", "versionType": "custom" } ] } ], "datePublic": "2020-09-01T00:00:00", "descriptions": [ { "lang": "en", "value": "Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with \"cf push\" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters." } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2020-09-03T01:10:16", "orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03", "shortName": "pivotal" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.cloudfoundry.org/blog/cve-2020-5420" } ], "source": { "discovery": "UNKNOWN" }, "title": "Gorouter is vulnerable to DoS attack via invalid HTTP responses", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@pivotal.io", "DATE_PUBLIC": "2020-09-01T00:00:00.000Z", "ID": "CVE-2020-5420", "STATE": "PUBLIC", "TITLE": "Gorouter is vulnerable to DoS attack via invalid HTTP responses" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Routing", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "All", "version_value": "0.206.0" } ] } }, { "product_name": "CF Deployment", "version": { "version_data": [ { "version_affected": "\u003c", "version_name": "All", "version_value": "13.15.0" } ] } } ] }, "vendor_name": "Cloud Foundry" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with \"cf push\" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters." } ] }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-754: Improper Check for Unusual or Exceptional Conditions" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.cloudfoundry.org/blog/cve-2020-5420", "refsource": "CONFIRM", "url": "https://www.cloudfoundry.org/blog/cve-2020-5420" } ] }, "source": { "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03", "assignerShortName": "pivotal", "cveId": "CVE-2020-5420", "datePublished": "2020-09-03T01:10:16.091101Z", "dateReserved": "2020-01-03T00:00:00", "dateUpdated": "2024-09-17T02:06:44.110Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Vulnerability from fkie_nvd
Published
2020-09-03 01:15
Modified
2024-11-21 05:34
Severity ?
Summary
Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters.
References
▼ | URL | Tags | |
---|---|---|---|
security@pivotal.io | https://www.cloudfoundry.org/blog/cve-2020-5420 | Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.cloudfoundry.org/blog/cve-2020-5420 | Vendor Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
cloudfoundry | cf-deployment | * | |
cloudfoundry | gorouter | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*", "matchCriteriaId": "9D87C642-F4E1-46DE-86D3-0D2A0E64A3A6", "versionEndExcluding": "13.15.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:cloudfoundry:gorouter:*:*:*:*:*:*:*:*", "matchCriteriaId": "CAAAF78A-33A1-4744-AF0F-43B7AE2FFAC3", "versionEndExcluding": "0.206.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with \"cf push\" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters." }, { "lang": "es", "value": "Cloud Foundry Routing (Gorouter) versiones anteriores a 0.206.0, permiten a un desarrollador malicioso con acceso \"cf push\" causar una denegaci\u00f3n de servicio al cl\u00faster CF al presionar una aplicaci\u00f3n que devuelve respuestas HTTP especialmente dise\u00f1adas que bloquean los Gorouters" } ], "id": "CVE-2020-5420", "lastModified": "2024-11-21T05:34:08.187", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "version": "2.0" }, "exploitabilityScore": 8.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security@pivotal.io", "type": "Secondary" } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2020-09-03T01:15:10.857", "references": [ { "source": "security@pivotal.io", "tags": [ "Vendor Advisory" ], "url": "https://www.cloudfoundry.org/blog/cve-2020-5420" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ], "url": "https://www.cloudfoundry.org/blog/cve-2020-5420" } ], "sourceIdentifier": "security@pivotal.io", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-754" } ], "source": "security@pivotal.io", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-754" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
var-202009-1291
Vulnerability from variot
Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters. Cloud Foundry is an open source platform as a service (PaaS) cloud computing platform of the Cloud Foundry Foundation in the United States. The product provides features such as container scheduling, continuous delivery, and automated service deployment. Routing is one of the routing components. There is a security vulnerability in Cloud Foundry Routing (Gorouter) versions earlier than 0.206.0. Attackers can use this vulnerability to cause the CF cluster to crash
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202009-1291", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "cf-deployment", "scope": "lt", "trust": 1.0, "vendor": "cloudfoundry", "version": "13.15.0" }, { "model": "gorouter", "scope": "lt", "trust": 1.0, "vendor": "cloudfoundry", "version": "0.206.0" } ], "sources": [ { "db": "NVD", "id": "CVE-2020-5420" } ] }, "cve": "CVE-2020-5420", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "CVE-2020-5420", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 1.1, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "VHN-183545", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:S/C:N/I:N/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.1, "id": "CVE-2020-5420", "impactScore": 4.0, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "security@pivotal.io", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.1, "id": "CVE-2020-5420", "impactScore": 4.0, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2020-5420", "trust": 1.0, "value": "HIGH" }, { "author": "security@pivotal.io", "id": "CVE-2020-5420", "trust": 1.0, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202009-273", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-183545", "trust": 0.1, "value": "MEDIUM" }, { "author": "VULMON", "id": "CVE-2020-5420", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-183545" }, { "db": "VULMON", "id": "CVE-2020-5420" }, { "db": "CNNVD", "id": "CNNVD-202009-273" }, { "db": "NVD", "id": "CVE-2020-5420" }, { "db": "NVD", "id": "CVE-2020-5420" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with \"cf push\" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters. Cloud Foundry is an open source platform as a service (PaaS) cloud computing platform of the Cloud Foundry Foundation in the United States. The product provides features such as container scheduling, continuous delivery, and automated service deployment. Routing is one of the routing components. There is a security vulnerability in Cloud Foundry Routing (Gorouter) versions earlier than 0.206.0. Attackers can use this vulnerability to cause the CF cluster to crash", "sources": [ { "db": "NVD", "id": "CVE-2020-5420" }, { "db": "VULHUB", "id": "VHN-183545" }, { "db": "VULMON", "id": "CVE-2020-5420" } ], "trust": 1.08 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2020-5420", "trust": 1.8 }, { "db": "CNNVD", "id": "CNNVD-202009-273", "trust": 0.7 }, { "db": "VULHUB", "id": "VHN-183545", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2020-5420", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-183545" }, { "db": "VULMON", "id": "CVE-2020-5420" }, { "db": "CNNVD", "id": "CNNVD-202009-273" }, { "db": "NVD", "id": "CVE-2020-5420" } ] }, "id": "VAR-202009-1291", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-183545" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T22:58:08.887000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Cloud Foundry Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=127454" } ], "sources": [ { "db": "CNNVD", "id": "CNNVD-202009-273" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-754", "trust": 1.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-183545" }, { "db": "NVD", "id": "CVE-2020-5420" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.8, "url": "https://www.cloudfoundry.org/blog/cve-2020-5420" }, { "trust": 0.6, "url": "https://tanzu.vmware.com/security/cve-2020-5420" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/754.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" } ], "sources": [ { "db": "VULHUB", "id": "VHN-183545" }, { "db": "VULMON", "id": "CVE-2020-5420" }, { "db": "CNNVD", "id": "CNNVD-202009-273" }, { "db": "NVD", "id": "CVE-2020-5420" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-183545" }, { "db": "VULMON", "id": "CVE-2020-5420" }, { "db": "CNNVD", "id": "CNNVD-202009-273" }, { "db": "NVD", "id": "CVE-2020-5420" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-09-03T00:00:00", "db": "VULHUB", "id": "VHN-183545" }, { "date": "2020-09-03T00:00:00", "db": "VULMON", "id": "CVE-2020-5420" }, { "date": "2020-09-03T00:00:00", "db": "CNNVD", "id": "CNNVD-202009-273" }, { "date": "2020-09-03T01:15:10.857000", "db": "NVD", "id": "CVE-2020-5420" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-09-11T00:00:00", "db": "VULHUB", "id": "VHN-183545" }, { "date": "2020-09-11T00:00:00", "db": "VULMON", "id": "CVE-2020-5420" }, { "date": "2020-10-22T00:00:00", "db": "CNNVD", "id": "CNNVD-202009-273" }, { "date": "2024-11-21T05:34:08.187000", "db": "NVD", "id": "CVE-2020-5420" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202009-273" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cloud Foundry Code problem vulnerability", "sources": [ { "db": "CNNVD", "id": "CNNVD-202009-273" } ], "trust": 0.6 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "code problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-202009-273" } ], "trust": 0.6 } }