Description (CNA)
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cloud Foundry / CredHub | affected 2.1 before 2.1.3; affected 1.9 before 1.9.10 |
| Cloud Foundry / UAA Release (OSS) | affected All before v64.0 |
| Cloud Foundry / cf-deployment | affected All before v7.9.0 |
| Pivotal / UAA Release (LTS) | affected v60 before v60.2; affected v64 before v64.1 |
CWE
CWE-494
References
ADP enrichment
No English description supplied.