Severity

High

Vendor

Pivotal

Description

Cloud Foundry Routing, all versions before 0.193.0, consumed by Pivotal Isolation Segment 2.5 versions prior to 2.5.14, 2.6 versions prior to 2.6.9 and 2.7 versions prior to 2.7.4, and Pivotal Application Service 2.5 versions prior to 2.5.15, 2.6 versions prior to 2.6.10 and 2.7 versions prior to 2.7.4, does not properly validate nonce input. A remote unauthenticated user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.

Affected VMware Products and Versions

Severity is high unless otherwise noted.

• Pivotal Isolation Segment
  • 2.5 versions prior to 2.5.14
  • 2.6 versions prior to 2.6.9
  • 2.7 versions prior to 2.7.4
• Pivotal Application Service (PAS)
  • 2.5 versions prior to 2.5.15
  • 2.6 versions prior to 2.6.10
  • 2.7 versions prior to 2.7.4

Mitigation

• Pivotal Isolation Segment
  • 2.5.14
  • 2.6.9
  • 2.7.4
• Pivotal Application Service (PAS)
  • 2.5.15
  • 2.6.10
  • 2.7.4

References

• https://www.cloudfoundry.org/blog/cve-2019-11289
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11289

History

2019-11-18: Initial vulnerability report published.