CVE-2017-14388

{"id": "CVE-2017-14388", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2017-11-13T17:29:00.537", "references": [{"url": "https://www.cloudfoundry.org/cve-2017-14388/", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.cloudfoundry.org/cve-2017-14388/", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer."}, {"lang": "es", "value": "La distribuci\u00f3n GrootFS de Cloud Foundry Foundation GrootFS en versiones 0.3.x anteriores a la 0.30.0 no valida DiffIDs, permitiendo que im\u00e1genes especialmente manipuladas da\u00f1en la memoria cach\u00e9 del volumen de grootfs. Por ejemplo, esto podr\u00eda permitir que un atacante proporcione una capa de imagen que GrootFS considerar\u00eda que es la capa base de Ubuntu."}], "lastModified": "2024-11-21T03:12:41.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C45C9A7-1893-41C0-B223-CE52EB9BC89A"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC40825D-0D84-473F-A773-A4BCD8ADD170"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8B7A818-F04D-414D-A77D-DF6E94AB8DEF"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1E03D0A-99CE-4F24-A270-60D0B26C8E1F"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE254721-5886-4E34-A584-AE28076311BF"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E93FCC50-28B4-4583-894D-BF251011BAD4"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95145C1C-56A5-4618-B9B1-AE7A85C8A79C"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D095614D-3618-4D2A-A549-209B4049695E"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54412F2F-3010-417F-8CC4-AD15C2C8071E"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EAD5A48-35EB-4FE8-BE35-FFF54A245BA9"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8D682F2-A07D-4A74-85FA-7EC7167F0A1B"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D289904-787F-4FDD-B47A-244605A0FE7F"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA6FCDF2-B6E5-4B6A-9A94-44C51A0D2160"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.16.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12CAAFF8-DC90-482A-BC21-8939457F5ACB"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.17.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A1D757F-ACEE-4FCB-B91F-879B2E9637C3"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.17.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BEF0E08-9AF7-4F8D-84D3-171DD1F0C566"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.18.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "842FBDD9-0624-4446-951D-9C601F4F9ADC"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.19.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB454D66-E728-408F-84DB-8C6846010A99"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.20.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "849E56E0-CE7F-4CB2-8D96-596F51A943DE"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.21.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "735C5982-6227-42B4-B055-AFF64148CDE4"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.24.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EB90CD2-9DD6-4699-BEAF-9CAD0E5C6750"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.25.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E81FF68C-FD88-41D0-A94F-D656FC268DCF"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.26.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABA6188A-D1E4-439E-BD97-818500CB2A22"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.27.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1195F98-3BAA-4AEB-B6E2-6021C686E7E1"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.28.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81485A7B-111E-4134-A4EC-70964DAB7042"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.28.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E8145EB-1C5C-4A2D-B0E2-C61BC453CF6B"}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.29.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54D11AD9-0B68-4BA8-A2C5-1743D6A4F07D"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}