Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2019-3801

Java Projects using HTTP to fetch dependencies

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dell

Description

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cloud Foundry CredHub

  • 2.1 to < 2.1.3affected
  • 1.9 to < 1.9.10affected

Cloud Foundry UAA Release (OSS)

  • All to < v64.0affected

Cloud Foundry cf-deployment

  • All to < v7.9.0affected

Pivotal UAA Release (LTS)

  • v60 to < v60.2affected
  • v64 to < v64.1affected

References