CVE-2019-3782: CredHub CLI writes environment variable credentials to disk
Severity
Medium
Vendor
Cloud Foundry Foundation
Affected Cloud Foundry Products and Versions
- CredHub CLI
- All versions prior to 2.2.1
Description
Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- CredHub CLI
- Upgrade All versions to 2.2.1 or greater
Credit
This issue was responsibly reported by StubHub.
History
2019-03-04: Updated credit section.
2019-02-11: Initial vulnerability report published.
