CVE-2019-3780: Cloud Foundry Container Runtime Leaks IAAS Credentials
Severity
Critical
Vendor
Cloud Foundry Foundation
Affected Cloud Foundry Products and Versions
- Cloud Foundry Container Runtime (CFCR)
- All versions prior to v0.28.0
Description
Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- Cloud Foundry Container Runtime (CFCR)
- Upgrade All versions to v0.28.0 or greater
Credit
This issue was responsibly reported by Swisscom.
History
2019-02-14: Initial vulnerability report published.
