Severity
High
Vendor
Cloud Foundry Foundation
Description
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.
Affected Cloud Foundry Products and Versions
- CF Deployment
- All versions prior to v12.8.0
- Routing
- All versions prior to 0.193.0
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- CF Deployment
- Upgrade All versions to v12.8.0 or greater
- Routing
- Upgrade All versions to 0.193.0 or greater
History
2019-11-18: Initial vulnerability report published.
2020-01-03: Updated description to clarify attack vector.
