Description
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Remediation
References
https://github.com/cloudfoundry/cf-release/releases/tag/v240
https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3
https://github.com/cloudfoundry/uaa/releases/tag/3.4.2
https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
https://pivotal.io/security/cve-2016-5016
Related Vulnerabilities
CVE-2019-18413 Vulnerability in npm package class-validator
CVE-2019-17571 Vulnerability in maven package log4j:log4j
CVE-2019-10795 Vulnerability in npm package undefsafe
CVE-2021-32624 Vulnerability in npm package keystone
CVE-2023-36542 Vulnerability in maven package org.apache.nifi:nifi-hbase_2-client-service