CVE-2020-5401: Cloud Foundry GoRouter is vulnerable to cache poisoning
Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cloud Foundry Routing Release (GoRouter)to a version that resolves this vulnerability.Fixed in 0.197.0 - Operational
After upgrading to a version at or after 0.197.0, verify access from legitimate clients because caching layers may reject subsequent requests caused by prior cache poisoning.
Event History
Frequently Asked Questions
What is CVE-2020-5401?
CVE-2020-5401 is a vulnerability in Cloud Foundry Routing Release versions prior to 0.197.0.
What is the severity of CVE-2020-5401?
The severity of CVE-2020-5401 is medium with a CVSS score of 5.3.
How does CVE-2020-5401 affect Cloud Foundry Routing Release?
CVE-2020-5401 affects Cloud Foundry Routing Release versions prior to 0.197.0 by allowing malicious clients to send invalid headers, which can cause caching layers to reject subsequent legitimate clients trying to access the app.
How do I fix CVE-2020-5401?
To fix CVE-2020-5401, update your Cloud Foundry Routing Release to version 0.197.0 or later.
Where can I find more information about CVE-2020-5401?
You can find more information about CVE-2020-5401 on the Cloud Foundry website: https://www.cloudfoundry.org/blog/cve-2020-5401