Vulnerability Description
In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cloudfoundry | Cf-Deployment | >= 27.4.0, < 29.0.0 |
| Cloudfoundry | Routing Release | >= 0.262.0, < 0.266.0 |
Related Weaknesses (CWE)
References
- https://www.cloudfoundry.org/blog/cve-2023-20882-gorouter-pruning-via-client-disVendor Advisory
- https://www.cloudfoundry.org/blog/cve-2023-20882-gorouter-pruning-via-client-disVendor Advisory
FAQ
What is CVE-2023-20882?
CVE-2023-20882 is a vulnerability with a CVSS score of 5.9 (MEDIUM). In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circu...
How severe is CVE-2023-20882?
CVE-2023-20882 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-20882?
Check the references section above for vendor advisories and patch information. Affected products include: Cloudfoundry Cf-Deployment, Cloudfoundry Routing Release.