{"containers": {"cna": {"affected": [{"product": "GrootFS release GrootFS release 0.3.x versions prior to 0.30.0", "vendor": "n/a", "versions": [{"status": "affected", "version": "GrootFS release GrootFS release 0.3.x versions prior to 0.30.0"}]}], "datePublic": "2017-11-13T00:00:00", "descriptions": [{"lang": "en", "value": "Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer."}], "problemTypes": [{"descriptions": [{"description": "Does not validate DiffIDs", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-11-13T17:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cloudfoundry.org/cve-2017-14388/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "ID": "CVE-2017-14388", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GrootFS release GrootFS release 0.3.x versions prior to 0.30.0", "version": {"version_data": [{"version_value": "GrootFS release GrootFS release 0.3.x versions prior to 0.30.0"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Does not validate DiffIDs"}]}]}, "references": {"reference_data": [{"name": "https://www.cloudfoundry.org/cve-2017-14388/", "refsource": "CONFIRM", "url": "https://www.cloudfoundry.org/cve-2017-14388/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:27:40.238Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cloudfoundry.org/cve-2017-14388/"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2017-14388", "datePublished": "2017-11-13T17:00:00", "dateReserved": "2017-09-12T00:00:00", "dateUpdated": "2024-08-05T19:27:40.238Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "7C45C9A7-1893-41C0-B223-CE52EB9BC89A", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "DC40825D-0D84-473F-A773-A4BCD8ADD170", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "B8B7A818-F04D-414D-A77D-DF6E94AB8DEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "B1E03D0A-99CE-4F24-A270-60D0B26C8E1F", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "DE254721-5886-4E34-A584-AE28076311BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "E93FCC50-28B4-4583-894D-BF251011BAD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "95145C1C-56A5-4618-B9B1-AE7A85C8A79C", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "D095614D-3618-4D2A-A549-209B4049695E", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "54412F2F-3010-417F-8CC4-AD15C2C8071E", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.12.0:*:*:*:*:*:*:*", "matchCriteriaId": "8EAD5A48-35EB-4FE8-BE35-FFF54A245BA9", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.13.0:*:*:*:*:*:*:*", "matchCriteriaId": "F8D682F2-A07D-4A74-85FA-7EC7167F0A1B", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.14.0:*:*:*:*:*:*:*", "matchCriteriaId": "5D289904-787F-4FDD-B47A-244605A0FE7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.15.0:*:*:*:*:*:*:*", "matchCriteriaId": "BA6FCDF2-B6E5-4B6A-9A94-44C51A0D2160", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.16.0:*:*:*:*:*:*:*", "matchCriteriaId": "12CAAFF8-DC90-482A-BC21-8939457F5ACB", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.17.0:*:*:*:*:*:*:*", "matchCriteriaId": "9A1D757F-ACEE-4FCB-B91F-879B2E9637C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.17.1:*:*:*:*:*:*:*", "matchCriteriaId": "2BEF0E08-9AF7-4F8D-84D3-171DD1F0C566", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.18.0:*:*:*:*:*:*:*", "matchCriteriaId": "842FBDD9-0624-4446-951D-9C601F4F9ADC", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.19.0:*:*:*:*:*:*:*", "matchCriteriaId": "BB454D66-E728-408F-84DB-8C6846010A99", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.20.0:*:*:*:*:*:*:*", "matchCriteriaId": "849E56E0-CE7F-4CB2-8D96-596F51A943DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.21.0:*:*:*:*:*:*:*", "matchCriteriaId": "735C5982-6227-42B4-B055-AFF64148CDE4", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.24.0:*:*:*:*:*:*:*", "matchCriteriaId": "5EB90CD2-9DD6-4699-BEAF-9CAD0E5C6750", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.25.0:*:*:*:*:*:*:*", "matchCriteriaId": "E81FF68C-FD88-41D0-A94F-D656FC268DCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.26.0:*:*:*:*:*:*:*", "matchCriteriaId": "ABA6188A-D1E4-439E-BD97-818500CB2A22", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.27.0:*:*:*:*:*:*:*", "matchCriteriaId": "C1195F98-3BAA-4AEB-B6E2-6021C686E7E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.28.0:*:*:*:*:*:*:*", "matchCriteriaId": "81485A7B-111E-4134-A4EC-70964DAB7042", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.28.1:*:*:*:*:*:*:*", "matchCriteriaId": "9E8145EB-1C5C-4A2D-B0E2-C61BC453CF6B", "vulnerable": true}, {"criteria": "cpe:2.3:a:pivotal_software:grootfs:0.29.0:*:*:*:*:*:*:*", "matchCriteriaId": "54D11AD9-0B68-4BA8-A2C5-1743D6A4F07D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer."}, {"lang": "es", "value": "La distribuci\u00f3n GrootFS de Cloud Foundry Foundation GrootFS en versiones 0.3.x anteriores a la 0.30.0 no valida DiffIDs, permitiendo que im\u00e1genes especialmente manipuladas da\u00f1en la memoria cach\u00e9 del volumen de grootfs. Por ejemplo, esto podr\u00eda permitir que un atacante proporcione una capa de imagen que GrootFS considerar\u00eda que es la capa base de Ubuntu."}], "id": "CVE-2017-14388", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-11-13T17:29:00.537", "references": [{"source": "security_alert@emc.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://www.cloudfoundry.org/cve-2017-14388/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://www.cloudfoundry.org/cve-2017-14388/"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}