CVE-2020-5400: Cloud Controller logs environment variables from app manifests
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cloud Foundry Cloud Controller (CAPI)to a version that resolves this vulnerability.Fixed in 1.91.0 - Compensating control
Ensure Cloud Controller logging does not expose environment variables/credentials from app manifests or background job properties (limit/log redaction) to prevent credentials from being accessible via logs.
Event History
Frequently Asked Questions
What is CVE-2020-5400?
CVE-2020-5400 is a vulnerability in Cloud Foundry Cloud Controller (CAPI) versions prior to 1.91.0.
How does CVE-2020-5400 affect Cloud Foundry?
CVE-2020-5400 allows a malicious user with access to job logs to potentially gain unauthorized access to protected resources in Cloud Foundry.
What software versions are affected by CVE-2020-5400?
Cloud Foundry Cloud Controller (CAPI) versions prior to 1.91.0 and cf-deployment versions prior to 12.33.0 are affected by CVE-2020-5400.
What is the severity of CVE-2020-5400?
The severity of CVE-2020-5400 is high with a CVSS score of 6.5.
How can I fix CVE-2020-5400?
To fix CVE-2020-5400, it is recommended to upgrade to Cloud Foundry Cloud Controller (CAPI) version 1.91.0 or later.