CVE-2018-15800: Timing attack allows extraction of signing key in Bits Service
Published Dec 10, 2018
·Updated
Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage.
Affected Software
1 affected component
Cloud Foundry Bits Service<2.18.0
Event History
Dec 10, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-15800?
CVE-2018-15800 is classified as an information disclosure vulnerability with a high severity level.
2
How do I fix CVE-2018-15800?
To fix CVE-2018-15800, upgrade Cloud Foundry Bits Service to version 2.18.0 or higher.
3
What type of attack does CVE-2018-15800 allow?
CVE-2018-15800 allows a remote malicious user to perform a timing attack to brute-force the signing key.
4
What are the consequences of CVE-2018-15800?
The consequences of CVE-2018-15800 include complete read and write access to the Bits Service storage.
5
Which versions of Cloud Foundry Bits Service are affected by CVE-2018-15800?
All versions of Cloud Foundry Bits Service prior to 2.18.0 are affected by CVE-2018-15800.