Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact What kind of vulnerability is it? Who is impacted? A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Patches Has the problem been patched? What versions should users upgrade to? This vulnerability is patched in the following versions: - etcd 3.6.11 - etcd 3.5.30 - etcd 3.4.44 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in…
Recommended action: Upgrade to 3.4.44 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd >= 3.4.0-rc.0, <= 3.4.9; < 3.3.23
Fixed in
3.3.233.4.10· Vendor fix available
Issue
Vulnerability type Cryptography Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward. References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 3.4.10 or 3.3.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd >= 3.4.0-rc.0, <= 3.4.9; < 3.3.23
Fixed in
3.3.233.4.10· Vendor fix available
Issue
Vulnerability type Denial of Service Detail The etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway. References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 3.4.10 or 3.3.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd < 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4
Fixed in
0.5.0-alpha.5.0.20200423152442-f4b650b51dc4· Vendor fix available
Issue
Vulnerability type Data Validation Detail The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL. Specific Go Packages Affected github.com/etcd-io/etcd/wal References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd < 0.5.0-alpha.5.0.20190108173120-83c051b701d3
Fixed in
0.5.0-alpha.5.0.20190108173120-83c051b701d3· Vendor fix available
Issue
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Recommended action: Upgrade to 0.5.0-alpha.5.0.20190108173120-83c051b701d3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
Recommended action: Upgrade to 3.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.