CVE-2016-6658

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2016-6658

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6658.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2016-6658

Published

2018-03-29T22:29:00.477Z

Modified

2026-07-08T05:48:18.230071607Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth) to access the buildpack through the CLI. For example, the user could include a GitHub username and password in the URL to access a private repo. Because the URL to access the buildpack is stored unencrypted, an operator with privileged access to the Cloud Controller database could view these credentials.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "245"
                }
            ],
            "cpes": [
                "cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "cloudfoundry:cf-release",
            "source": "CPE_RANGE"
        },
        {
            "source": "CPE_RANGE",
            "cpes": [
                "cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "pivotal_software:cloud_foundry_elastic_runtime",
            "extracted_events": [
                {
                    "fixed": "1.6.49"
                },
                {
                    "fixed": "1.6.49"
                },
                {
                    "introduced": "1.7.0"
                },
                {
                    "fixed": "1.7.31"
                },
                {
                    "introduced": "1.7.0"
                },
                {
                    "fixed": "1.7.31"
                },
                {
                    "introduced": "1.8.0"
                },
                {
                    "fixed": "1.8.11"
                },
                {
                    "introduced": "1.8.0"
                },
                {
                    "fixed": "1.8.11"
                }
            ]
        }
    ]
}

References

https://pivotal.io/security/cve-2016-6658

Affected packages

Git / github.com/cloudfoundry-attic/cf-release

Affected ranges

Type

GIT

Repo

https://github.com/cloudfoundry-attic/cf-release

Events

Introduced

Fixed

1a84cd71377a1ac645f76c686156142ea0685067

Database specific

{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "245"
        }
    ]
}

Affected versions

Other

list

log

scotty_09012012

v100

v102

v103

v104

v105

v109

v119

v132

v133

v134

v135

v136

v137

v140

v143

v156

v157

v161

v170

v183

v205

v99

works-for-us

rc145.*

rc145.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6658.json"