CVE-2019-3801
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2019
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Java Projects using HTTP to fetch dependencies
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
CredHub
- Vendor
- Cloud Foundry
- Product
- CredHub
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.1 | affected | custom | 2.1.3 | Unavailable | None listed |
| 1.9 | affected | custom | 1.9.10 | Unavailable | None listed |
UAA Release (OSS)
- Vendor
- Cloud Foundry
- Product
- UAA Release (OSS)
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| All | affected | custom | v64.0 | Unavailable | None listed |
cf-deployment
- Vendor
- Cloud Foundry
- Product
- cf-deployment
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| All | affected | custom | v7.9.0 | Unavailable | None listed |
UAA Release (LTS)
- Vendor
- Pivotal
- Product
- UAA Release (LTS)
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| v60 | affected | custom | v60.2 | Unavailable | None listed |
| v64 | affected | custom | v64.1 | Unavailable | None listed |