CVE-2019-3801

CVE-2019-3801 is a critical vulnerability affecting Cloud Foundry cf-deployment versions prior to 7.9.0, as well as CredHub and UAA_release, where Java components use an insecure protocol to fetch dependencies during build. This allows a remote, unauthenticated attacker to hijack DNS entries for dependencies and inject malicious code, leading to complete compromise of confidentiality, integrity, and availability. With a CVSS score of 9.8 (CRITICAL), the attack is network-based and low complexity, requiring no user interaction. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion, indicating awareness within the cybersecurity community.