CVE-2016-5016: Medium severity cloud foundry vulnerability
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5016?
CVE-2016-5016 is classified as a medium severity vulnerability.
How do I fix CVE-2016-5016?
To fix CVE-2016-5016, upgrade to Cloud Foundry UAA version 3.4.2 or later, or to Pivotal Cloud Foundry Elastic Runtime versions 1.6.35 or 1.7.13 and later.
Which versions of Pivotal Cloud Foundry are affected by CVE-2016-5016?
Pivotal Cloud Foundry versions up to 239 are affected by CVE-2016-5016.
What components should I update affected by CVE-2016-5016?
You should update the User Account and Authentication Server (UAA) and Pivotal Cloud Foundry Elastic Runtime components.
Is my version vulnerable if I’m using UAA 3.4.1 or earlier in CVE-2016-5016?
Yes, UAA version 3.4.1 and earlier are vulnerable to CVE-2016-5016.