What’s Vulnerable › Vulnerabilities

CVE-2019-3801: Java Projects using HTTP to fetch dependencies

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-25 · updated 2026-06-17
• Weakness: CWE-494

Description

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.

Affected products

• Cloud Foundry cf-deployment: before 7.9.0 — fixed in 7.9.0
• Cloud Foundry CredHub: from 1.9 before 1.9.10; from 2.1 before 2.1.3 — fixed in 1.9.10, 2.1.3
• Cloudfoundry Uaa Release: before 64.0 — fixed in 64.0

How to fix

Upgrade to a fixed version: Cloud Foundry cf-deployment 7.9.0; Cloud Foundry CredHub 1.9.10, 2.1.3; Cloudfoundry Uaa Release 64.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/108104
• https://www.cloudfoundry.org/blog/cve-2019-3801
• http://www.securityfocus.com/bid/108104
• https://www.cloudfoundry.org/blog/cve-2019-3801

Get alerted when CVE-2019-3801 or the next vulnerability affects your stack