Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-14390: cf-deployment can send logs to unintended locations

CVE-2017-14390 · published 8 years ago

Summary

The cf-deployment version 0.35.0 configuration can cause log data to be forwarded to places you didn't intend, exposing internal information. This happens because the Loggregator component and the syslog-drain setup are not correctly restricted. Review and correct the Loggregator and syslog-drain settings to ensure logs only go to approved destinations.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
pivotal_software	cf-deployment	0.35.0 `cpe:2.3:a:pivotal_software:cf-deployment:0.35.0:::::::*`

Original advisory text

In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to unintended locations.

References

http://www.securityfocus.com/bid/101972 Third Party Advisory VDB Entry
https://www.cloudfoundry.org/cve-2017-14390/ Issue Tracking Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Timeline

Published27 Nov 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-14390 · NVD

Track software like this

Free during beta