Cloud Foundry Logo

CVE-2019-11289: Gorouter header denial of service vulnerability

By: | November 18, 2019

Share

Severity

High

Vendor

Cloud Foundry Foundation

Description

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.

Affected Cloud Foundry Products and Versions

  • CF Deployment
    • All versions prior to v12.8.0
  • Routing
    • All versions prior to 0.193.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

  • CF Deployment
    • Upgrade All versions to v12.8.0 or greater
  • Routing
    • Upgrade All versions to 0.193.0 or greater

History

2019-11-18: Initial vulnerability report published.

2020-01-03: Updated description to clarify attack vector.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR

SEE ALL ARTICLES