Skip to content
OpenAdvisories
High · 7.6 CVE-2020-5399 EUVD-2020-26578GHSA-w39h-6cmp-6crw

CredHub does not properly enable TLS for MySQL database connections

Published Feb 12, 2020 · Updated Sep 16, 2024 · Assigned by pivotal

Description

Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.

Affected products

VendorProductAffectedFixed
Cloud Foundry CredHub Edge – < 2.5.10 2.5.10

References