CVE-2016-0780 Cloud Controller Disk Quota EnforcementSeverity

*High*Vendor

*Cloud Foundry Foundation*Versions Affected

*cf-release v231 and lower*Description

*It was discovered that Cloud Foundry does not properly enforce disk quotas
in certain cases. An attacker could use an improper disk quota value to
bypass enforcement and consume all the disk on DEAs/Diego Cells causing a
potential denial of service for other applications.*Mitigation


* - Upgrade to cf-release v233 [1] (cf-release v232 is not recommended for
use)*Credit

*Fujitsu Limited*References

*[1] https://github.com/cloudfoundry/cf-release/releases/tag/v233
<https://github.com/cloudfoundry/cf-release/releases/tag/v233>*History2016-Mar-23:
Initial vulnerability report published