CVE-2017-14388
Last modified
CVE-2017-14388 is a vulnerability of currently unknown severity. Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer.. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Grootfs | 0.3.0 |
| Pivotal Software | Grootfs | 0.4.0 |
| Pivotal Software | Grootfs | 0.5.0 |
| Pivotal Software | Grootfs | 0.6.0 |
| Pivotal Software | Grootfs | 0.7.0 |
| Pivotal Software | Grootfs | 0.8.0 |
| Pivotal Software | Grootfs | 0.9.0 |
| Pivotal Software | Grootfs | 0.10.0 |
| Pivotal Software | Grootfs | 0.11.0 |
| Pivotal Software | Grootfs | 0.12.0 |
| Pivotal Software | Grootfs | 0.13.0 |
| Pivotal Software | Grootfs | 0.14.0 |
| Pivotal Software | Grootfs | 0.15.0 |
| Pivotal Software | Grootfs | 0.16.0 |
| Pivotal Software | Grootfs | 0.17.0 |
| Pivotal Software | Grootfs | 0.17.1 |
| Pivotal Software | Grootfs | 0.18.0 |
| Pivotal Software | Grootfs | 0.19.0 |
| Pivotal Software | Grootfs | 0.20.0 |
| Pivotal Software | Grootfs | 0.21.0 |
| Pivotal Software | Grootfs | 0.24.0 |
| Pivotal Software | Grootfs | 0.25.0 |
| Pivotal Software | Grootfs | 0.26.0 |
| Pivotal Software | Grootfs | 0.27.0 |
| Pivotal Software | Grootfs | 0.28.0 |
| Pivotal Software | Grootfs | 0.28.1 |
| Pivotal Software | Grootfs | 0.29.0 |
References
- https://www.cloudfoundry.org/cve-2017-14388/Issue Tracking, Vendor Advisory
- https://www.cloudfoundry.org/cve-2017-14388/Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14388?
How severe is CVE-2017-14388?
How do I fix CVE-2017-14388?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14382Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-14383In Dell EMC VNX2 versions prior to Operating Environment for…
- CVE-2017-14384In Dell Storage Manager versions earlier than 16.3.20, the E…
- CVE-2017-14385An issue was discovered in EMC Data Domain DD OS 5.7 family,…
- CVE-2017-14386The web user interface of Dell 2335dn and 2355dn Multifuncti…
- CVE-2017-14387The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1…
- CVE-2017-14389An issue was discovered in Cloud Foundry Foundation capi-rel…6.5
- CVE-2017-1439IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.…
- CVE-2017-14390In Cloud Foundry Foundation cf-deployment v0.35.0, a misconf…
- CVE-2017-14391Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2017-14392Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2017-14393Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
Are you affected by CVE-2017-14388?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST