Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable.
References
Link | Resource |
---|---|
https://www.cloudfoundry.org/blog/cve-2019-3786 | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: dell
Published: 2019-04-08T00:00:00
Updated: 2019-04-24T15:21:10
Reserved: 2019-01-03T00:00:00
Link: CVE-2019-3786
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-04-24T16:29:01.920
Modified: 2020-10-16T17:51:48.060
Link: CVE-2019-3786
JSON object: View
Redhat Information
No data.