Cloud Foundry Logo
blog single gear
Security Advisory

CVE-2017-4972: Blind SQL Injection in UAA

CVE-2017-4972: Blind SQL Injection in UAA

Severity

High

Vendor

Cloud Foundry Foundation

Versions Affected

  • cf-release versions prior to v257
  • UAA release:
    • 2.x versions prior to v2.7.4.14
    • 3.6.x versions prior to v3.6.8
    • 3.9.x versions prior to v3.9.10
    • Other versions prior to v3.15.0
  • UAA bosh release (uaa-release):
    • 13.x versions prior to v13.12
    • 24.x versions prior to v24.7
    • Other versions prior to v30

Description

An attacker can use a blind SQL injection attack to query the contents of the UAA database.

Mitigation

OSS users are strongly encouraged to follow one of the mitigations below:

  • Upgrade to Cloud Foundry v257 [1] or later
  • For standalone UAA users:
    • For users using UAA Version 3.0.0 – 3.14.0, please upgrade to UAA Release to v3.15.0 [2] or v3.9.10 [3] or v3.6.8 [4]
    • For users using standalone UAA Version 2.X.X, please upgrade to UAA Release to v2.7.4.14 [5]
    • For users using UAA-Release (UAA bosh release), please upgrade to UAA-Release v30 [6] if upgrading to v3.15.0 [2] or v24.7 [7] if upgrading to v3.9.10 [3] and v13.12 [8] if upgrading to v3.6.8 [4]

References

History

2017-04-19: Initial vulnerability report published

 

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR

SEE ALL ARTICLES