« Back to list

CVE-2017-14388

Status: ModifiedHigh (7.8)—

Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Pivotal Software — Grootfs

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-14388",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "GrootFS release GrootFS release 0.3.x versions prior to 0.30.0",
          "versions": [
            {
              "status": "affected",
              "version": "GrootFS release GrootFS release 0.3.x versions prior to 0.30.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-13T17:29:00.537",
  "references": [
    {
      "url": "https://www.cloudfoundry.org/cve-2017-14388/",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.cloudfoundry.org/cve-2017-14388/",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer."
    },
    {
      "lang": "es",
      "value": "La distribución GrootFS de Cloud Foundry Foundation GrootFS en versiones 0.3.x anteriores a la 0.30.0 no valida DiffIDs, permitiendo que imágenes especialmente manipuladas dañen la memoria caché del volumen de grootfs. Por ejemplo, esto podría permitir que un atacante proporcione una capa de imagen que GrootFS consideraría que es la capa base de Ubuntu."
    }
  ],
  "lastModified": "2026-06-17T01:06:03.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C45C9A7-1893-41C0-B223-CE52EB9BC89A"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC40825D-0D84-473F-A773-A4BCD8ADD170"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8B7A818-F04D-414D-A77D-DF6E94AB8DEF"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1E03D0A-99CE-4F24-A270-60D0B26C8E1F"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE254721-5886-4E34-A584-AE28076311BF"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E93FCC50-28B4-4583-894D-BF251011BAD4"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95145C1C-56A5-4618-B9B1-AE7A85C8A79C"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D095614D-3618-4D2A-A549-209B4049695E"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54412F2F-3010-417F-8CC4-AD15C2C8071E"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EAD5A48-35EB-4FE8-BE35-FFF54A245BA9"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8D682F2-A07D-4A74-85FA-7EC7167F0A1B"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.14.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D289904-787F-4FDD-B47A-244605A0FE7F"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA6FCDF2-B6E5-4B6A-9A94-44C51A0D2160"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.16.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12CAAFF8-DC90-482A-BC21-8939457F5ACB"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A1D757F-ACEE-4FCB-B91F-879B2E9637C3"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.17.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BEF0E08-9AF7-4F8D-84D3-171DD1F0C566"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.18.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "842FBDD9-0624-4446-951D-9C601F4F9ADC"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.19.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB454D66-E728-408F-84DB-8C6846010A99"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.20.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "849E56E0-CE7F-4CB2-8D96-596F51A943DE"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.21.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "735C5982-6227-42B4-B055-AFF64148CDE4"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EB90CD2-9DD6-4699-BEAF-9CAD0E5C6750"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.25.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E81FF68C-FD88-41D0-A94F-D656FC268DCF"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.26.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABA6188A-D1E4-439E-BD97-818500CB2A22"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.27.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1195F98-3BAA-4AEB-B6E2-6021C686E7E1"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.28.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81485A7B-111E-4134-A4EC-70964DAB7042"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.28.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E8145EB-1C5C-4A2D-B0E2-C61BC453CF6B"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:grootfs:0.29.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54D11AD9-0B68-4BA8-A2C5-1743D6A4F07D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}