NVD Vulnerability Detail

CVE-2016-5016

Summary	Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Publication Date	April 25, 2017, 4:59 a.m.
Registration Date	Jan. 26, 2021, 2:13 p.m.
Last Update	Nov. 21, 2024, 11:53 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:pivotal_software:cloud_foundry_uaa::::::::		3.4.1
cpe:2.3:a:pivotal_software:cloud_foundry::::::::		239
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime::::::::	1.6.0			1.6.35
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime::::::::	1.7.0			1.7.13
cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release::::::::		12.2

Related information, measures and tools

No	URL	タグ
1	https://github.com/cloudfoundry/cf-release/releases/tag/v240	Release Notes Third Party Advisory
2	https://github.com/cloudfoundry/cf-release/releases/tag/v240	Release Notes Third Party Advisory
3	https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6	Release Notes Third Party Advisory
4	https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6	Release Notes Third Party Advisory
5	https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3	Release Notes Third Party Advisory
6	https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3	Release Notes Third Party Advisory
7	https://github.com/cloudfoundry/uaa/releases/tag/3.4.2	Release Notes Third Party Advisory
8	https://github.com/cloudfoundry/uaa/releases/tag/3.4.2	Release Notes Third Party Advisory
9	https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3	Release Notes Third Party Advisory
10	https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3	Release Notes Third Party Advisory
11	https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3	Release Notes Third Party Advisory
12	https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3	Release Notes Third Party Advisory
13	https://pivotal.io/security/cve-2016-5016	Vendor Advisory
14	https://pivotal.io/security/cve-2016-5016	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-295	不正な証明書検証	https://cwe.mitre.org/data/definitions/295.html

JVN Vulnerability Information

複数の Cloud Foundry 製品における証明書検証に関する脆弱性

Title	複数の Cloud Foundry 製品における証明書検証に関する脆弱性
Summary	複数の Cloud Foundry 製品には、証明書検証に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 21, 2016, midnight
Registration Date	May 26, 2017, 4:27 p.m.
Last Update	May 26, 2017, 4:27 p.m.

Affected System

Cloud Foundry Foundation

Cloud Foundry

Elastic Runtime

UAA

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-5016	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5016
National Vulnerability Database (NVD)
2	CVE-2016-5016	https://nvd.nist.gov/vuln/detail/CVE-2016-5016
Pivotal Software, Inc.
3	CVE-2016-5016 UAA accepts expired certificates	https://pivotal.io/security/cve-2016-5016

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-295	https://cwe.mitre.org/data/definitions/295.html

ベンダー情報

No	Name	URL
GitHub
1	UAA 2.7.4.6 - Security Release (CVE-2016-5016)	https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
2	UAA 3.3.0.3 - Security Release (CVE-2016-5016)	https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3
3	UAA 3.4.2 - Security Release (CVE-2016-5016)	https://github.com/cloudfoundry/uaa/releases/tag/3.4.2
4	Updated to UAA 3.3.0.3	https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
5	Updated to UAA 3.4.2	https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
6	v240	https://github.com/cloudfoundry/cf-release/releases/tag/v240

Change Log

No	Changed Details	Date of change
0	[2017年05月26日] 掲載	Feb. 17, 2018, 10:37 a.m.