CVE-2019-3801

Java Projects using HTTP to fetch dependencies

State: Published
Severity: 8.7 High
Published: Apr 25, 2019
Updated: Sep 17, 2024
Reserved: Jan 3, 2019

Description

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.

Scores

CVSS	Score	Vector	Source
3.0	8.7 High	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N	dell

Weaknesses

CWE-494 Download of Code Without Integrity Check

Affected Products

Product	Versions
CredHubCloud Foundry	2.1 to before 2.1.3Affected 1.9 to before 1.9.10Affected
UAA Release (OSS)Cloud Foundry	All to before v64.0Affected
cf-deploymentCloud Foundry	All to before v7.9.0Affected
UAA Release (LTS)Pivotal	v60 to before v60.2Affected v64 to before v64.1Affected

References

https://www.cloudfoundry.org/blog/cve-2019-3801
108104vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.