Description
In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read files on the host system that the BOSH-created vcap user has permissions to read and then package them into their app droplet.
Metrics
CVSS 3.0 7.5/10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Dell EMC | Garden Nstar | Garden versions 0.22.0-0.329.0 |
References
- https://pivotal.io/security/cve-2015-5350Vendor Advisory
- https://pivotal.io/security/cve-2015-5350Vendor Advisory
Timeline
- Published
- Mar 19, 2018
- Last modified
- Jun 17, 2026
- NVD status
- Modified