HIGH🇵🇱 Wersja polska

CVE-2019-3779

CVSS 8.8v3.0pub. 2019-03-08upd. 2024-11-21

Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the Kubernetes CSR capability to obtain a credential that could escalate privilege access to ETCD.

CVSS Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cloudfoundry Container Runtime

    APP
    Cloudfoundry
    < 0.29.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Container
CWE
References

Related vulnerabilities

CVE-2019-3780HIGH8.8same product

Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configurat...

CVE-2022-31733CRITICAL9.1PL ✓same vendor

Cloudfoundry Diego — pominięcie uwierzytelniania mTLS przez niezabezpieczony port

CVE-2018-25046CRITICAL9.1PL ✓same vendor

Path traversal w Cloudfoundry Archiver umożliwia zapis plików poza katalogiem docelowym

CVE-2019-3801CRITICAL9.8PL ✓same vendor

Cloud Foundry cf-deployment: wstrzyknięcie kodu przez niezaszyfrowany protokół pobierania zależności

CVE-2016-6658CRITICAL9.6PL ✓same vendor

Ujawnienie danych uwierzytelniających buildpack w Cloud Foundry CF-Release