CVE-2023-20881
First published: Fri May 19 2023(Updated: )
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cloudfoundry Capi-release | >=1.140<=1.152.0 | |
| Cloudfoundry Cf-deployment | >=24.7.0<=29.0.0 | |
| Cloudfoundry Loggregator-agent | >=7.0<=7.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-20881?
CVE-2023-20881 is a vulnerability that affects Cloud Foundry instances with CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+.
What is the severity of CVE-2023-20881?
CVE-2023-20881 has a severity rating of 8.1 (high).
How does CVE-2023-20881 affect Cloud Foundry instances?
CVE-2023-20881 allows users with knowledge of the client certificate used for a syslog drain to override other users' syslog drain credentials.
Which versions of Cloud Foundry are affected by CVE-2023-20881?
Cloud Foundry instances with CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ are affected by CVE-2023-20881.
How can I fix CVE-2023-20881?
To fix CVE-2023-20881, users should update their Cloud Foundry instances to a version that is not affected by this vulnerability.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/cloudfoundry
- canonical/cloudfoundry capi-release
- version/cloudfoundry capi-release/1.140
- version/cloudfoundry capi-release/1.152.0
- canonical/cloudfoundry cf-deployment
- version/cloudfoundry cf-deployment/24.7.0
- version/cloudfoundry cf-deployment/29.0.0
- canonical/cloudfoundry loggregator-agent
- version/cloudfoundry loggregator-agent/7.0
- version/cloudfoundry loggregator-agent/7.2.1