Severity
LOW
Vendor
CloudFoundry Foundation
Versions Affected
- UAA Release: v77.21.0 to v77.31.0
- CF Deployment: v45.1.0 to v48.11.0
Description
Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
Affected Cloud Foundry Products and Versions
*Severity is high unless otherwise noted.
- uaa_release
-
- All versions from v77.21.0 to v77.31.0 (inclusive)
- CF Deployment
-
- All versions from v45.1.0 to v48.11.0 (inclusive)
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below.
The Cloud Foundry project recommends upgrading the following releases:
- uaa_release
-
- Upgrade uaa_release versions to v77.32.0 or greater
- CF Deployment
-
- Upgrade cf-deployment version to v49.0.0 or greater
-
-
- Includes uaa_release v77.32.0
-
Credit
Self reported by the UAA Cloud Foundry team
History
May 8th, 2025: Initial vulnerability report published.
