CVE-2017-4960: High severity Cloudfoundry Cloud Foundry Uaa Bosh vulnerability
An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.cloudfoundry.identity:cloudfoundry-identity-serverto a version that resolves this vulnerability.Fixed in 3.9.8 - Upgrade
Upgrade
maven/org.cloudfoundry.identity:cloudfoundry-identity-serverto a version that resolves this vulnerability.Fixed in 3.12.0
Event History
Frequently Asked Questions
What is the vulnerability description for CVE-2017-4960?
CVE-2017-4960 allows UAA OAuth clients to be subjected to a denial of service attack due to a flaw in Cloud Foundry releases v247 through v252.
What versions of software are affected by CVE-2017-4960?
CVE-2017-4960 affects Cloud Foundry release v247 to v252, UAA stand-alone releases v3.9.0 to v3.11.0, and UAA Bosh Releases v21 to v26.
How do I mitigate the risks associated with CVE-2017-4960?
To mitigate CVE-2017-4960, upgrade to Cloud Foundry identity server version 3.9.8 or to 3.12.0 or later.
Is CVE-2017-4960 a critical vulnerability?
CVE-2017-4960 is considered a high severity vulnerability due to its potential to enable denial of service attacks.
What impact does CVE-2017-4960 have on cloud applications?
CVE-2017-4960 can disrupt service availability for applications using the affected UAA OAuth clients, potentially leading to outages.