CERT-FR: Multiple VMware Tanzu vulnerabilities across Platform Services, Hub, buildpacks and stemcells (CERTFR-2026-AVI-1385)

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1385 covers many vulnerabilities in VMware (Broadcom) Tanzu Platform products. The vendor does not specify the impact, and CERT-FR only says an attacker could trigger an unspecified security issue. No CVSS score, attacker prerequisites or per-CVE impact is given. Affected: API Gateway before 2.4.10, Platform Services 10.x before 10.4.6 and before 11.0.0, Service Publisher before 10.4.6, Ruby Buildpack before 1.10.95, Staticfile Buildpack before 1.6.103, Tanzu Hub before 10.4.6 and 11.0.0, GemFire and Tanzu for Postgres before 11.0.0, TKGI Mgmt Console before 1.26.3, and several Ubuntu Jammy, Ubuntu Resolute and Windows 2019/2022 stemcells. The CVE list is long (mostly 2002 to 2017) and truncated in the source.

Como funciona

The articles do not describe how any of these flaws work or what input reaches which component. The advisory only lists affected products and versions and points to the vendor bulletins for fixes. No mechanism can be stated without guessing.

Por que é vulnerável

The advisory does not state a root cause. The story notes that the CVEs, mostly from 2002 to 2017, appear to be flaws in third-party components bundled in these products, but this is an inference and not confirmed by the vendor. The fix is to update to the patched versions named in the Broadcom bulletins.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published its advisory on 26 October 2026, based on a batch of Broadcom/VMware security bulletins dated 21 October 2026 (IDs 39354 to 39403, plus DSA-2021-33 and DSA-2026-37). No active exploitation or IOCs are reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 14:20.

6 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2016-0772, CVE-2014-4650, CVE-2008-4864 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

1. exploit-db.com · EDB-43500 ↗ · local · multiple · pub. 03/07/2016 não verificado

   Python smtplib 2.7.11 / 3.4.4 / 3.5.1 - Man In The Middle StartTLS Stripping

   This is a write-up of a flaw in Python's smtplib (2.7.11, 3.4.4, 3.5.1 and older), not a classic exploit: if a mail server advertises STARTTLS but replies to the upgrade with an unexpected code, starttls() raises no error and the session continues unencrypted. The attacker must be a man in the middle between client and mail server, needs no authentication, and the victim program must not check the returned status itself. The result is TLS stripping, exposing message contents and credentials. It is a working proof of concept using a separate proxy tool, with a patch included.

   CVE-2016-0772 · autor: tintinweb · explicação gerada por IA
2. exploit-db.com · EDB-33894 ↗ · aplicação web · multiple · pub. 27/06/2014 verificado

   Python CGIHTTPServer - Encoded Directory Traversal

   This is an advisory with simple demonstrations, not a script, and it matches CVE-2014-4650 in Python's CGIHTTPServer module (2.7 to 2.7.7, 3.2 to 3.4.1). The server decides whether a URL is a CGI call before decoding it, so an encoded slash makes it serve a CGI script as a plain file. An unauthenticated remote attacker who can reach the server can read CGI source code, exposing embedded credentials, or run scripts in nested or parent directories. It is a working, easily reproduced technique, limited to the server's working directory.

   CVE-2014-4650 · autor: RedTeam Pentesting · explicação gerada por IA
3. exploit-db.com · EDB-10229 ↗ · negação de serviço · multiple · pub. 24/11/2009 verificado

   Python < 2.5.2 Imageop Module - 'imageop.crop()' Buffer Overflow

   This entry targets the imageop module in Python versions before 2.5.2, specifically its crop function, which miscalculates buffer sizes and overflows memory. The attacker must be able to run Python code that calls the function, or influence an application that passes attacker-controlled image dimensions to it; no authentication or network access is involved by itself. The tiny proof of concept only crashes the interpreter, so it is a denial-of-service trigger. The advisory says code execution in the application's context is possible, but no working exploit is provided. It does match CVE-2008-4864.

   CVE-2008-4864 · autor: Chris Evans · explicação gerada por IA

1. exploit-db.com · EDB-32534 ↗ · negação de serviço · unix · pub. 27/10/2008 verificado

   Python 2.5.2 - 'Imageop' Module Argument Validation Buffer Overflow

   CVE-2008-4864 · autor: Chris Evans
2. exploit-db.com · EDB-30592 ↗ · negação de serviço · multiple · pub. 17/09/2007 verificado

   Python 2.2 ImageOP Module - Multiple Integer Overflow Vulnerabilities

   CVE-2007-4965 · autor: Slythers Bro
3. exploit-db.com · EDB-1591 ↗ · local · linux · pub. 18/03/2006 verificado

   Python 2.4.2 - 'realpath()' Local Stack Overflow

   CVE-2006-1542 · autor: Gotfault Security

Detalhes técnicos

Remediação