CVE-2019-3801
Java Projects using HTTP to fetch dependencies
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.1.3, 1.9.10, v64.0, v7.9.0, v60.2, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.
Timeline
- CVE published
- Record last updated
Affected versions
- Cloud Foundry CredHub
From 2.1 · fixed in 2.1.3; From 1.9 · fixed in 1.9.10
- Cloud Foundry UAA Release (OSS)
fixed in v64.0
- Cloud Foundry cf-deployment
fixed in v7.9.0
- Pivotal UAA Release (LTS)
From v60 · fixed in v60.2; From v64 · fixed in v64.1