| Package | Affected versions | Patched versions |
|---|---|---|
| capi-release | = 1.10.0= 1.11.0= 1.12.0= 1.13.0= 1.14.0= 1.15.0= 1.16.0= 1.17.0= 1.18.0= 1.19.0= 1.20.0= 1.21.0= 1.22.0= 1.23.0= 1.24.0= 1.25.0= 1.26.0= 1.27.0= 1.28.0= 1.29.0= 1.30.0= 1.31.0= 1.32.0= 1.33.0= 1.34.0= 1.35.0= 1.36.0= 1.37.0= 1.7.0= 1.8.0= 1.9.0 | |
| cf-release | = 245= 246= 247= 248= 249= 250= 251= 252= 253= 254= 255= 256= 257= 258= 259= 260= 261= 262= 263= 264= 265= 266= 267= 268= 269 |
In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free