critical9.6
CVE-2016-6658
Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack.
Impact
Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth) to access the buildpack through the CLI. For example, the user could include a GitHub username and password in the URL to access a private repo. Because the URL to access the buildpack is stored unencrypted, an operator with privileged access to the Cloud Controller database could view these credentials.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cloudfoundry | Cf-Release | before 245 |
| Pivotal Software | Cloud Foundry Elastic Runtime | before 1.6.49 from 1.7.0 before 1.7.31 from 1.8.0 before 1.8.11 |