GHSA-rc2r-w8jv-vggp

Source

https://github.com/advisories/GHSA-rc2r-w8jv-vggp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rc2r-w8jv-vggp/GHSA-rc2r-w8jv-vggp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rc2r-w8jv-vggp

Aliases

CVE-2016-5016

Published

2022-05-14T01:30:57Z

Modified

2024-02-28T23:26:47.283043Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Cloud Foundry vulnerable to Improper Certificate Validation

Details

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

Database specific

{
    "nvd_published_at": "2017-04-24T19:59:00Z",
    "cwe_ids": [
        "CWE-295"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-28T22:58:21Z"
}

References

Affected packages

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.3.0.3

Affected versions

3.*

3.0.0

3.0.1

3.1.0

3.2.0

3.2.1

3.3.0

3.3.0.1

3.3.0.2

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server