CVE-2020-5423 — Cloud Controller is vulnerable to denial of service via YAML parsing

CVE-2020-5423

Cloud Controller is vulnerable to denial of service via YAML parsing PUBLISHED

Description (CNA)

CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.

Affected (CNA)

Vendor / product	Versions
Cloud Foundry / CAPI	affected All before 1.101.0
Cloud Foundry / CF Deployment	affected All before 15.0.0

CWE

CWE-400

References

https://www.cloudfoundry.org/blog/cve-2020-5423

ADP enrichment

CVE

No English description supplied.

https://www.cloudfoundry.org/blog/cve-2020-5423