Severity
Low
Vendor
Cloud Foundry Foundation
Versions Affected
- Cloud Foundry Release versions prior to 250
- CAPI versions prior to 1.12.0
Description
The Cloud Foundry Cloud Controller /v2/apps endpoint logs environment variables in plaintext when pushing a manifest containing environment variables or when setting environment variables using cf set-env. The sensitive information appears in the Cloud Controller component logs, which are often aggregated with other system component logs via syslog.
Mitigation
OSS users are strongly encouraged to follow one of the mitigations below:
- Upgrade to Cloud Foundry v250 [1] or later
- For standalone component users:
- CAPI v1.12.0 [2] or later
Credit
This vulnerability was responsibly reported by the Cloud Controller team.
References
- [1] https://github.com/cloudfoundry/cf-release/releases
- [2] https://github.com/cloudfoundry/capi-release/releases
History
2016-08-10: Initial vulnerability report published
