CVE-2018-1276: Windows2012R2 stemcell exposes IaaS metadata on vSphere
Cloud Foundry Foundation
Affected Cloud Foundry Products and Versions
- You are using Windows 2012R2 stemcells versions prior to 1200.17
Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can execute crafted commands to read the IaaS metadata from the VM, which may contain BOSH credentials.
Users of affected versions should apply the following mitigations or upgrades:
- Releases that have fixed this issue include:
- Windows 2012R2 stemcells version 1200.17
This issue was responsibly reported by the BOSH Windows team.
2018-05-16: Initial vulnerability report published.