Description
An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Cloud Foundry Foundation Cloud Foundry release v247 - v252, UAA stand-alone release v3.9.0 - v3.11.0, UAA Bosh Release v21 - v26 | Cloud Foundry Foundation Cloud Foundry release v247 - v252, UAA stand-alone release v3.9.0 - v3.11.0, UAA Bosh Release v21 - v26 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >= 3.10.0, < 3.12.0 | 3.12.0 | GHSA-hxgw-7539-pv7r |
| Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | < 3.9.8 | 3.9.8 | GHSA-hxgw-7539-pv7r |