CVE-2018-1277

moderate-risk
Published 2018-04-30

Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an app with a malicious Docker image that will consume more space on a Diego cell than allocated in their quota, potentially causing a DoS against the cell.

Do I need to act?

-
0.52% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Garden-Runc

Affected Vendors

Cloudfoundry

References (2)

Vendor Advisory https://www.cloudfoundry.org/blog/cve-2018-1277/
Vendor Advisory https://www.cloudfoundry.org/blog/cve-2018-1277/
33
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 2/34 · Minimal
Exposure 7/34 · Low