CVE-2017-4970

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-4970

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-4970.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-4970

Published

2017-06-13T06:29:00Z

Modified

2026-08-27T03:47:27Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile buildpack versions v1.4.0 - v1.4.3. A regression introduced in the Static file build pack causes the Staticfile.auth configuration to be ignored when the Static file file is not present in the application root. Applications containing a Staticfile.auth file but not a Static file had their basic auth turned off when an operator upgraded the Static file build pack in the foundation to one of the vulnerable versions. Note that Static file applications without a Static file are technically misconfigured, and will not successfully detect unless the Static file build pack is explicitly specified.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.3:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "1.4.3"
                },
                {
                    "last_affected": "1.4.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "cloudfoundry:staticfile_buildpack"
        }
    ]
}

References

https://www.cloudfoundry.org/cve-2017-4970/

Affected packages

Git / github.com/cloudfoundry-attic/cf-release

Affected ranges

Type

GIT

Repo

https://github.com/cloudfoundry-attic/cf-release

Events

Introduced

d5295bc2fb9e5d84254470c1fa5cd3ea10d80a05

Last Affected

d5295bc2fb9e5d84254470c1fa5cd3ea10d80a05

Database specific

Show details

{
    "cpe": "cpe:2.3:a:cloudfoundry:cf-release:255:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "255"
        },
        {
            "last_affected": "255"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

Other

255

v255

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-4970.json"

Git / github.com/cloudfoundry/staticfile-buildpack

Affected ranges

Type

GIT

Repo

https://github.com/cloudfoundry/staticfile-buildpack

Events

Introduced

7b401f7a84a36b9180af87deec9e2aeb4f2ccd31

Last Affected

a62436383bd9f94d141a5e1cc448283595cce0ab

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.2:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        },
        {
            "introduced": "1.4.1"
        },
        {
            "last_affected": "1.4.1"
        },
        {
            "introduced": "1.4.2"
        },
        {
            "last_affected": "1.4.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.4.0

1.4.1

1.4.2

v1.*

v1.4.0

v1.4.1

v1.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-4970.json"