CWE
200
Advisory Published
Updated

CVE-2016-6658: Infoleak

First published: Thu Mar 29 2018(Updated: )

Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth) to access the buildpack through the CLI. For example, the user could include a GitHub username and password in the URL to access a private repo. Because the URL to access the buildpack is stored unencrypted, an operator with privileged access to the Cloud Controller database could view these credentials.

Credit: security_alert@emc.com

Affected SoftwareAffected VersionHow to fix
Cloudfoundry Cf-release<245
Pivotal Software Cloud Foundry Elastic Runtime<1.6.49
Pivotal Software Cloud Foundry Elastic Runtime>=1.7.0<1.7.31
Pivotal Software Cloud Foundry Elastic Runtime>=1.8.0<1.8.11

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2016-6658?

    CVE-2016-6658 is a vulnerability in cf-release before version 245 that allows a user to configure and push applications with a user-provided custom buildpack using a URL that can contain credentials.

  • How severe is CVE-2016-6658?

    CVE-2016-6658 has a severity rating of 9.6, which is classified as critical.

  • What software is affected by CVE-2016-6658?

    The affected software includes Cloudfoundry Cf-release before version 245 and Pivotal Software Cloud Foundry Elastic Runtime versions up to 1.6.49, 1.7.31, and 1.8.11.

  • How can the vulnerability in CVE-2016-6658 be exploited?

    The vulnerability can be exploited by specifying credentials in the URL pointing to the user-provided custom buildpack, allowing unauthorized access to the buildpack through the CLI.

  • Is there a fix available for CVE-2016-6658?

    Yes, upgrading to cf-release version 245 or later can fix the vulnerability. Additionally, upgrading Pivotal Software Cloud Foundry Elastic Runtime to versions above 1.6.49, 1.7.31, and 1.8.11 can also address the issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203