CVE:CVE-2019-3801
CNNVD:CNNVD-201904-1213
Cloud Foundry UAA等都是美国Cloud Foundry基金会的产品。Cloud Foundry UAA是一款应用于CloudFoundry云平台的身份验证和管理服务终端。Cloud Foundry CredHub是一款为Cloud Foundry设计的集中凭证管理组件。Cloud Foundry cf-deployment是一款Cloud Foundry部署工具。
Cloud Foundry CredHub、UAA Release和cf-deployment中存在安全漏洞。远程攻击者可利用该漏洞向组件中注入恶意代码。以下产品和版本受到影响：Cloud Foundry CredHub 2.1.3之前的2.1版本，1.9.10之前的1.9版本；cf-deployment 7.9.0之前版本；UAA Release (OSS) 64.0之前版本。
solution:Upgrade cloudfoundry cf-deployment to a higher version than 7.9.0,and avoid the version (,7.9.0); Upgrade cloudfoundry credhub to a higher version than 1.9.10,2.1.3,and avoid the version [1.9,1.9.10),[2.1,2.1.3); Upgrade cloudfoundry uaa_release to a higher version than 64.0,and avoid the version (,64.0)