What’s Vulnerable › Vulnerabilities

CVE-2016-5016

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-04-24 · updated 2026-06-17
• Weakness: CWE-295

Description

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

Affected products

• Pivotal Cloud Foundry: through 239
• PCF Elastic Runtime: from 1.6.0 before 1.6.35; from 1.7.0 before 1.7.13 — fixed in 1.6.35, 1.7.13
• Cloud Foundry UAA: through 3.4.1
• Cloud Foundry UAA Release (OSS): through 12.2

How to fix

Upgrade to a fixed version: PCF Elastic Runtime 1.6.35, 1.7.13. Check the vendor advisory for mitigations.

References

• https://github.com/cloudfoundry/cf-release/releases/tag/v240
• https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
• https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
• https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
• https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3
• https://github.com/cloudfoundry/uaa/releases/tag/3.4.2
• https://pivotal.io/security/cve-2016-5016
• https://github.com/cloudfoundry/cf-release/releases/tag/v240
• https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
• https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
• https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
• https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3

Get alerted when CVE-2016-5016 or the next vulnerability affects your stack