CVE-2019-3781

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.

Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.

This update for cf-cli fixes the following issues:

cf-cli was updated: to version 6.43.0 (bsc#1132242)

Enhancements :

• cf curl supports a new --fail flag (primarily for scripting purposes) which returns exit code 22 for server errors story
• Improves cf delete-orphaned-routes such that it uses a different endpoint, reducing the chance of a race condition when two users are simultaneously deleting orphaned routes and associating routes with applications story
• we've improved the speed of cf services - it now hits a single endpoint instead of making individual API calls

Security:

• CVE-2019-3781: CF CLI does not sanitize user’s password in verbose/trace/debug.
• Fixes issue with running cf login in verbose mode whereby passwords which contains regex were not completely redacted
• Fixes issue whilst running commands in verbose mode refresh tokens were not completely redacted

Other Bug Fixes:

• Updates help text for cf curlstory
• Now refresh tokens work properly whilst using cf curl with V3 CC API endpoints story
• Fixes performance degradation for cf services story
• cf delete-service requires that you are targeting a space story
• cf enable-service access for a service in an org will succeed if you have already enabled access for that service in that org story

cf-cli was updated to version 6.42.0:

Minor Enhancements:

• updated cf restage help text and the first line in the command's output to indicate that using this command will cause app downtime story
• updated the cf bind-route-service help text to clarify usage instructions story
• improved an error message for cf create-service-boker to be more helpful when the CC API returns a 502 due to an invalid service broker catalog
• upgraded to Golang 1.11.4 story
• added a short name ue for cf unset-env story
• updated cf marketplace command to include a new broker column to prepare for a upcoming services-related feature which will allow services to have the same name as long as they are associated with different service brokers story

Bugs:

• fix for cf enable-service-access -p plan whereby when we refactored the code in CLI v6.41.0 it created service plan visibilities as part of a subsequent run of the command (the unrefactored code skipped creating the service plan visibilities); now the command will skip creating service plan visibilities as it did prior to the refactor story
• updated the cf rename-buildpack help text which was missing reference to the -s stack flag story
• updated help text for when users use brew search cloudfoundry-cli story
• now when you run cf service service-instance for a route service, the route service url appears in the key value table story

Update to version 6.41.0:

Enhancements:

• updated cf --help to include the delete command story

Update to version 6.40.1:

Bug Fixes:

• Updates the minimum version for the buildpacks-stacks association feature. In CLI v6.39.0, when the feature was released, we incorrectly set the minimum to cc api version as2.114. The minimum cc api version is now correctly set to 2.112. story
• Fixes a bug with inspecting a service…

This update for cf-cli fixes the following issues:

cf-cli was updated: to version 6.43.0 (bsc#1132242)

Enhancements :

• cf curl supports a new --fail flag (primarily for scripting purposes) which returns exit code 22 for server errors story
• Improves cf delete-orphaned-routes such that it uses a different endpoint, reducing the chance of a race condition when two users are simultaneously deleting orphaned routes and associating routes with applications story
• we've improved the speed of cf services - it now hits a single endpoint instead of making individual API calls

Security:

• CVE-2019-3781: CF CLI does not sanitize user’s password in verbose/trace/debug.
• Fixes issue with running cf login in verbose mode whereby passwords which contains regex were not completely redacted
• Fixes issue whilst running commands in verbose mode refresh tokens were not completely redacted

Other Bug Fixes:

• Updates help text for cf curlstory
• Now refresh tokens work properly whilst using cf curl with V3 CC API endpoints story
• Fixes performance degradation for cf services story
• cf delete-service requires that you are targeting a space story
• cf enable-service access for a service in an org will succeed if you have already enabled access for that service in that org story

cf-cli was updated to version 6.42.0:

Minor Enhancements:

• updated cf restage help text and the first line in the command's output to indicate that using this command will cause app downtime story
• updated the cf bind-route-service help text to clarify usage instructions story
• improved an error message for cf create-service-boker to be more helpful when the CC API returns a 502 due to an invalid service broker catalog
• upgraded to Golang 1.11.4 story
• added a short name ue for cf unset-env story
• updated cf marketplace command to include a new broker column to prepare for a upcoming services-related feature which will allow services to have the same name as long as they are associated with different service brokers story

Bugs:

• fix for cf enable-service-access -p plan whereby when we refactored the code in CLI v6.41.0 it created service plan visibilities as part of a subsequent run of the command (the unrefactored code skipped creating the service plan visibilities); now the command will skip creating service plan visibilities as it did prior to the refactor story
• updated the cf rename-buildpack help text which was missing reference to the -s stack flag story
• updated help text for when users use brew search cloudfoundry-cli story
• now when you run cf service service-instance for a route service, the route service url appears in the key value table story

Update to version 6.41.0:

Enhancements:

• updated cf --help to include the delete command story

Update to version 6.40.1:

Bug Fixes:

• Updates the minimum version for the buildpacks-stacks association feature. In CLI v6.39.0, when the feature was released, we incorrectly set the minimum to cc api version as2.114. The minimum cc api version is now correctly set to 2.112. story
• Fixes a bug with inspecting a service…