An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
An issue was discovered in Cloud Foundry Foundation cf-release v255 and Staticfile buildpack versions v1.4.0 - v1.4.3. A regression introduced in the Static file build pack causes the Staticfile.auth configuration to be ignored when the Static file file is not present in the application root. Applications containing a Staticfile.auth file but not a Static file had their basic auth turned off when an operator upgraded the Static file build pack in the foundation to one of the vulnerable versions. Note that Static file applications without a Static file are technically misconfigured, and will not successfully detect unless the Static file build pack is explicitly specified.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cloud Foundry | Cloud Foundry | — | No fix listed | CNA |
- Cloud Foundry Vendor— Affected Cloud Foundry Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cf-release:255:*:*:*:*:*:*:* | 255 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.0:*:*:*:*:*:*:* | 1.4.0 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.1:*:*:*:*:*:*:* | 1.4.1 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.2:*:*:*:*:*:*:* | 1.4.2 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.3:*:*:*:*:*:*:* | 1.4.3 | Vulnerable | CloudFoundry Foundation |
- cpe:2.3:a:cloudfoundry:cf-release:255:*:*:*:*:*:*:* Versions 255 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:staticfile_buildpack:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·CloudFoundry Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-4970
- 2026-10-03 Alias added: GHSA-xvcr-4h4q-m7m8
References
More CloudFoundry Foundation Cf-release vulnerabilities
- TI-2016-05702 Command injection in Cloud Foundry CVSS 3.0CRITICAL 9.8
- TI-2016-06771 Improper input validation in Cloud Foundry CVSS 3.0CRITICAL 9.8
- TI-2017-03116 Improper privilege management in Cloud Foundry CVSS 3.1CRITICAL 9.8
- TI-2015-04340 Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry… CVSS 3.1CRITICAL 9.8
- TI-2015-04339 The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA… CVSS 3.1CRITICAL 9.8
- TI-2016-05705 Applications in cf-release before 245 can be configured and pushed with a user-provided… CVSS 3.0CRITICAL 9.6
Sources
- CVE-2017-4970 · CVE Program
- CVE-2017-4970 · NVD
- FIRST EPSS
- GHSA-xvcr-4h4q-m7m8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences