VMSA-2019-0016

VMware Security Advisories

Advisory ID	VMSA-2019-0016
Advisory Severity	Critical
CVSSv3 Range	9.1
Synopsis	VMware Cloud Foundation and VMware Harbor Container Registry for PCF address broken access control vulnerability (CVE-2019-16919)
Issue Date	2019-10-15
Updated On	2019-12-11
CVE(s)	CVE-2019-16919

1. Impacted Products

VMware Cloud Foundation
VMware Harbor Container Registry for PCF

2. Introduction

A broken access control vulnerability in Harbor, a Cloud Native Computing Foundation (CNCF) Open Source Project, was disclosed. Patches are available to remediate this vulnerability in affected VMware products.

3. Broken access control vulnerability in Harbor API (CVE-2019-16919)

Description:

A Broken Access Control vulnerability in the API of Harbor may allow for unauthorized access to push/pull/modify images in an adjacent project. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.1.

Known Attack Vectors:

A malicious actor with administrative access to a project may be able to create a robot account inside of an adjacent project via the Harbor API. Successful exploitation of this issue may lead to unauthorized access to push/pull/modify images in the target adjacent project.

Resolution:

To remediate CVE-2019-16919, apply the patches listed in the 'Fixed Version' column of the 'Resolution Matrix' found below.

Workarounds:

None.

Additional Documentation:

None.

Notes:

None.

Acknowledgements:

None.

Response Matrix:

Security

Security Advisories

Product	Version	Running On	CVE Identifier	CVSSV3	Severity	Fixed Version	Workarounds	Additional Documents
VMware Cloud Foundation*	x.x	Any	CVE-2019-16919	9.1	Critical	3.9.0	None	None
VMware Harbor Container Registry for PCF	1.8.x	Any	CVE-2019-16919	9.1	Critical	1.8.4	None	None
VMware Harbor Container Registry for PCF	1.7.x	Any	CVE-2019-16919	N/A	N/A	Unaffected	None	None