CVEvulnerability

CVE-2017-14388

7.8 HIGH Published 2017-11-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-11-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer.

Affected configurations

• pivotal software grootfs 0.3.0 • pivotal software grootfs 0.4.0 • pivotal software grootfs 0.5.0 • pivotal software grootfs 0.6.0 • pivotal software grootfs 0.7.0 • pivotal software grootfs 0.8.0 • pivotal software grootfs 0.9.0 • pivotal software grootfs 0.10.0 • pivotal software grootfs 0.11.0 • pivotal software grootfs 0.12.0 • pivotal software grootfs 0.13.0 • pivotal software grootfs 0.14.0 • pivotal software grootfs 0.15.0 • pivotal software grootfs 0.16.0 • pivotal software grootfs 0.17.0 • pivotal software grootfs 0.17.1 • pivotal software grootfs 0.18.0 • pivotal software grootfs 0.19.0 • pivotal software grootfs 0.20.0 • pivotal software grootfs 0.21.0 • pivotal software grootfs 0.24.0 • pivotal software grootfs 0.25.0 • pivotal software grootfs 0.26.0 • pivotal software grootfs 0.27.0 • pivotal software grootfs 0.28.0 • pivotal software grootfs 0.28.1 • pivotal software grootfs 0.29.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References