| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| cf-release | < 245 | 245 |
| cloud foundry elastic runtime | ≥ 1.7.0, < 1.7.31≥ 1.8.0, < 1.8.11< 1.6.49 | 1.7.311.8.111.6.49 |
Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth) to access the buildpack through the CLI. For example, the user could include a GitHub username and password in the URL to access a private repo. Because the URL to access the buildpack is stored unencrypted, an operator with privileged access to the Cloud Controller database could view these credentials.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン