CVE-2015-5350: High severity Cloudfoundry Garden vulnerability
In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read files on the host system that the BOSH-created vcap user has permissions to read and then package them into their app droplet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5350?
CVE-2015-5350 has a moderate severity rating due to the potential for unauthorized file access on the host system.
How do I fix CVE-2015-5350?
To mitigate CVE-2015-5350, upgrade to Garden version 0.330.0 or later.
What versions of Garden are affected by CVE-2015-5350?
CVE-2015-5350 affects Garden versions from 0.22.0 to 0.329.0.
What specific component is vulnerable in CVE-2015-5350?
The vulnerability in CVE-2015-5350 is found in the nstar executable of the Garden component.
How can CVE-2015-5350 be exploited?
CVE-2015-5350 can be exploited by using a malicious custom buildpack to stage an application on Cloud Foundry.