Description
Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu. Affected versions: BOSH agent < v2.847.0 (jammy <= v1.1202, or noble <= v1.364). Lower bound unspecified in advisory ("All bosh agent versions").
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
CloudFoundry Foundation BOSH
Default version status: unaffected
0 to < 2.847.0affected