CVE-2019-11289: Gorouter header denial of service vulnerability | Cloud Foundry

Severity

High

Vendor

Cloud Foundry Foundation

Description

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.

Affected Cloud Foundry Products and Versions

• CF Deployment
  • All versions prior to v12.8.0
• Routing
  • All versions prior to 0.193.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• CF Deployment
  • Upgrade All versions to v12.8.0 or greater
• Routing
  • Upgrade All versions to 0.193.0 or greater

History

2019-11-18: Initial vulnerability report published.

2020-01-03: Updated description to clarify attack vector.