CVE-2017-8037: Infoleak
First published: Mon Aug 21 2017(Updated: )
In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cloud Foundry CAPI-release | =1.7.0 | |
| Cloud Foundry CAPI-release | =1.8.0 | |
| Cloud Foundry CAPI-release | =1.9.0 | |
| Cloud Foundry CAPI-release | =1.10.0 | |
| Cloud Foundry CAPI-release | =1.11.0 | |
| Cloud Foundry CAPI-release | =1.12.0 | |
| Cloud Foundry CAPI-release | =1.13.0 | |
| Cloud Foundry CAPI-release | =1.14.0 | |
| Cloud Foundry CAPI-release | =1.15.0 | |
| Cloud Foundry CAPI-release | =1.16.0 | |
| Cloud Foundry CAPI-release | =1.17.0 | |
| Cloud Foundry CAPI-release | =1.18.0 | |
| Cloud Foundry CAPI-release | =1.19.0 | |
| Cloud Foundry CAPI-release | =1.20.0 | |
| Cloud Foundry CAPI-release | =1.21.0 | |
| Cloud Foundry CAPI-release | =1.22.0 | |
| Cloud Foundry CAPI-release | =1.23.0 | |
| Cloud Foundry CAPI-release | =1.24.0 | |
| Cloud Foundry CAPI-release | =1.25.0 | |
| Cloud Foundry CAPI-release | =1.26.0 | |
| Cloud Foundry CAPI-release | =1.27.0 | |
| Cloud Foundry CAPI-release | =1.28.0 | |
| Cloud Foundry CAPI-release | =1.29.0 | |
| Cloud Foundry CAPI-release | =1.30.0 | |
| Cloud Foundry CAPI-release | =1.31.0 | |
| Cloud Foundry CAPI-release | =1.32.0 | |
| Cloud Foundry CAPI-release | =1.33.0 | |
| Cloud Foundry CAPI-release | =1.34.0 | |
| Cloud Foundry CAPI-release | =1.35.0 | |
| Cloud Foundry CAPI-release | =1.36.0 | |
| Cloud Foundry CAPI-release | =1.37.0 | |
| Cloud Foundry CF Release | =245 | |
| Cloud Foundry CF Release | =246 | |
| Cloud Foundry CF Release | =247 | |
| Cloud Foundry CF Release | =248 | |
| Cloud Foundry CF Release | =249 | |
| Cloud Foundry CF Release | =250 | |
| Cloud Foundry CF Release | =251 | |
| Cloud Foundry CF Release | =252 | |
| Cloud Foundry CF Release | =253 | |
| Cloud Foundry CF Release | =254 | |
| Cloud Foundry CF Release | =255 | |
| Cloud Foundry CF Release | =256 | |
| Cloud Foundry CF Release | =257 | |
| Cloud Foundry CF Release | =258 | |
| Cloud Foundry CF Release | =259 | |
| Cloud Foundry CF Release | =260 | |
| Cloud Foundry CF Release | =261 | |
| Cloud Foundry CF Release | =262 | |
| Cloud Foundry CF Release | =263 | |
| Cloud Foundry CF Release | =264 | |
| Cloud Foundry CF Release | =265 | |
| Cloud Foundry CF Release | =266 | |
| Cloud Foundry CF Release | =267 | |
| Cloud Foundry CF Release | =268 | |
| Cloud Foundry CF Release | =269 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2017-8037?
CVE-2017-8037 has a moderate severity level, indicating it could potentially lead to unauthorized access or data exposure.
How do I fix CVE-2017-8037?
To remedy CVE-2017-8037, upgrade to Cloud Foundry CAPI-release versions 1.38.0 or newer, and cf-release versions 270 or newer.
Which versions are affected by CVE-2017-8037?
CVE-2017-8037 affects CAPI-release versions after v1.6.0 and before v1.38.0, as well as cf-release versions after v244 and before v270.
Is CVE-2017-8037 related to CVE-2017-8035?
Yes, CVE-2017-8037 represents an incomplete fix for the vulnerabilities identified in CVE-2017-8035.
What should I do if I have already remediated CVE-2017-8035?
If you have remediated CVE-2017-8035, you should also ensure to upgrade your versions to address CVE-2017-8037.
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cloudfoundry
- canonical/cloud foundry capi-release
- version/cloud foundry capi-release/1.7.0
- version/cloud foundry capi-release/1.8.0
- version/cloud foundry capi-release/1.9.0
- version/cloud foundry capi-release/1.10.0
- version/cloud foundry capi-release/1.11.0
- version/cloud foundry capi-release/1.12.0
- version/cloud foundry capi-release/1.13.0
- version/cloud foundry capi-release/1.14.0
- version/cloud foundry capi-release/1.15.0
- version/cloud foundry capi-release/1.16.0
- version/cloud foundry capi-release/1.17.0
- version/cloud foundry capi-release/1.18.0
- version/cloud foundry capi-release/1.19.0
- version/cloud foundry capi-release/1.20.0
- version/cloud foundry capi-release/1.21.0
- version/cloud foundry capi-release/1.22.0
- version/cloud foundry capi-release/1.23.0
- version/cloud foundry capi-release/1.24.0
- version/cloud foundry capi-release/1.25.0
- version/cloud foundry capi-release/1.26.0
- version/cloud foundry capi-release/1.27.0
- version/cloud foundry capi-release/1.28.0
- version/cloud foundry capi-release/1.29.0
- version/cloud foundry capi-release/1.30.0
- version/cloud foundry capi-release/1.31.0
- version/cloud foundry capi-release/1.32.0
- version/cloud foundry capi-release/1.33.0
- version/cloud foundry capi-release/1.34.0
- version/cloud foundry capi-release/1.35.0
- version/cloud foundry capi-release/1.36.0
- version/cloud foundry capi-release/1.37.0
- canonical/cloud foundry cf release
- version/cloud foundry cf release/245
- version/cloud foundry cf release/246
- version/cloud foundry cf release/247
- version/cloud foundry cf release/248
- version/cloud foundry cf release/249
- version/cloud foundry cf release/250
- version/cloud foundry cf release/251
- version/cloud foundry cf release/252
- version/cloud foundry cf release/253
- version/cloud foundry cf release/254
- version/cloud foundry cf release/255
- version/cloud foundry cf release/256
- version/cloud foundry cf release/257
- version/cloud foundry cf release/258
- version/cloud foundry cf release/259
- version/cloud foundry cf release/260
- version/cloud foundry cf release/261
- version/cloud foundry cf release/262
- version/cloud foundry cf release/263
- version/cloud foundry cf release/264
- version/cloud foundry cf release/265
- version/cloud foundry cf release/266
- version/cloud foundry cf release/267
- version/cloud foundry cf release/268
- version/cloud foundry cf release/269