Vulnerability-Lookup

CNVD-2017-00062

Vulnerability from cnvd - Published: 2017-01-04

Title

Pivotal MySQL for PCF信息泄露漏洞

Description

MySQL for PCF是美国Pivotal公司的产品，它使CloudFoundry用户能够在高度可用的复制服务器集群上配置MySQL数据库，并自动将用户凭据提供给运行时环境变量中的应用程序。 MySQL for PCF存在信息泄露漏洞。攻击者可利用此漏洞获取敏感信息。

Severity

中

Patch Name

Pivotal MySQL for PCF信息泄露漏洞的补丁

Patch Description

MySQL for PCF是美国Pivotal公司的产品，它使CloudFoundry用户能够在高度可用的复制服务器集群上配置MySQL数据库，并自动将用户凭据提供给运行时环境变量中的应用程序。 MySQL for PCF存在信息泄露漏洞。攻击者可利用此漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可联系供应商获得补丁信息： https://pivotal.io/

Reference

http://www.securityfocus.com/bid/95146

Impacted products

Name
Pivotal MySQL for PCF 1.7.*，<1.7.10

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "95146"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-0898",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0898"
    }
  },
  "description": "MySQL for PCF\u662f\u7f8e\u56fdPivotal\u516c\u53f8\u7684\u4ea7\u54c1\uff0c\u5b83\u4f7fCloudFoundry\u7528\u6237\u80fd\u591f\u5728\u9ad8\u5ea6\u53ef\u7528\u7684\u590d\u5236\u670d\u52a1\u5668\u96c6\u7fa4\u4e0a\u914d\u7f6eMySQL\u6570\u636e\u5e93\uff0c\u5e76\u81ea\u52a8\u5c06\u7528\u6237\u51ed\u636e\u63d0\u4f9b\u7ed9\u8fd0\u884c\u65f6\u73af\u5883\u53d8\u91cf\u4e2d\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nMySQL for PCF\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Pivotal Team",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://pivotal.io/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-00062",
  "openTime": "2017-01-04",
  "patchDescription": "MySQL for PCF\u662f\u7f8e\u56fdPivotal\u516c\u53f8\u7684\u4ea7\u54c1\uff0c\u5b83\u4f7fCloudFoundry\u7528\u6237\u80fd\u591f\u5728\u9ad8\u5ea6\u53ef\u7528\u7684\u590d\u5236\u670d\u52a1\u5668\u96c6\u7fa4\u4e0a\u914d\u7f6eMySQL\u6570\u636e\u5e93\uff0c\u5e76\u81ea\u52a8\u5c06\u7528\u6237\u51ed\u636e\u63d0\u4f9b\u7ed9\u8fd0\u884c\u65f6\u73af\u5883\u53d8\u91cf\u4e2d\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nMySQL for PCF\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Pivotal MySQL for PCF\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Pivotal MySQL for PCF 1.7.*\uff0c\u003c1.7.10"
  },
  "referenceLink": "http://www.securityfocus.com/bid/95146",
  "serverity": "\u4e2d",
  "submitTime": "2016-12-30",
  "title": "Pivotal MySQL for PCF\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2016-0898 (GCVE-0-2016-0898)

Vulnerability from cvelistv5 – Published: 2018-03-29 22:00 – Updated: 2024-08-05 22:38

Summary

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM.

Severity

No CVSS data available.

CWE

Assigner

dell

References

2 references

URL	Tags
http://www.securityfocus.com/bid/95146	vdb-entryx_refsource_BID
https://pivotal.io/security/cve-2016-0898	x_refsource_CONFIRM

Date Public

2016-12-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:38:41.135Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "95146",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95146"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://pivotal.io/security/cve-2016-0898"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-12-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-30T09:57:02.000Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "95146",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95146"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://pivotal.io/security/cve-2016-0898"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2016-0898",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "95146",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95146"
            },
            {
              "name": "https://pivotal.io/security/cve-2016-0898",
              "refsource": "CONFIRM",
              "url": "https://pivotal.io/security/cve-2016-0898"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2016-0898",
    "datePublished": "2018-03-29T22:00:00.000Z",
    "dateReserved": "2015-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:38:41.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-00062

CVE-2016-0898 (GCVE-0-2016-0898)

Tags

Sightings

Nomenclature