CVE-2016-5016
First published: Mon Apr 24 2017(Updated: )
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <=239 | ||
| Pivotal Software Cloud Foundry Elastic Runtime | >=1.6.0<1.6.35 | |
| Pivotal Software Cloud Foundry Elastic Runtime | >=1.7.0<1.7.13 | |
| Pivotal Software Cloud Foundry Uaa | <=3.4.1 | |
| Pivotal Software Cloud Foundry Uaa-release | <=12.2 | |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.4.0<3.4.2 | 3.4.2 |
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.0.0<3.3.0.3 | 3.3.0.3 |
| Pivotal Software Cloud Foundry | <=239 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/cloudfoundry/cf-release/releases/tag/v240
- https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
- https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
- https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
- https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3
- https://github.com/cloudfoundry/uaa/releases/tag/3.4.2
- https://pivotal.io/security/cve-2016-5016
- https://nvd.nist.gov/vuln/detail/CVE-2016-5016
- https://github.com/cloudfoundry/uaa/commit/0a78612f981c541ad2d997e6a365f2a0b3e799d9
- https://github.com/cloudfoundry/uaa/commit/bc91ccd2029e8f1cea0c647f0c9aad4585f7a2c
- https://github.com/cloudfoundry/uaa/commit/f97049df1c6c03effda5049c41704ac831ff3925
- https://github.com/advisories/GHSA-rc2r-w8jv-vggp (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rc2r-w8jv-vggp
- alias/CVE-2016-5016
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- agent/softwarecombine
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/pivotal software
- canonical/pivotal software cloud foundry elastic runtime
- version/pivotal software cloud foundry elastic runtime/1.6.0
- version/pivotal software cloud foundry elastic runtime/1.7.0
- canonical/pivotal software cloud foundry uaa
- version/pivotal software cloud foundry uaa/3.4.1
- canonical/pivotal software cloud foundry uaa-release
- version/pivotal software cloud foundry uaa-release/12.2
- package-manager/maven
- canonical/pivotal software cloud foundry
- version/pivotal software cloud foundry/239