Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexicographically greater than or equal to their permitted key — not just the one key they were granted. This is an authorization bypass in etcd's RBAC enforcement for the Watch API; Range/Get and DeleteRange requests are not affected. It only affects clusters with authentication enabled — clusters running without auth already allow unrestricted read access. Patches Has the problem been patched? What versions should users upgrade to? This vulnerability is patched in the following versions: - etcd 3.7.1 - etcd 3.6.14 - etcd 3.5.33 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? If upgrading is not immediately possible, the following mitigations reduce exposure: - Audit READ…
Recommended action: Upgrade to 3.7.1, 3.6.14 or 3.5.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane). Patches Has the problem been patched? What versions should users upgrade to? This vulnerability is patched in the following versions: - etcd 3.7.1 - etcd 3.6.14 - etcd 3.5.33 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation. Reporter VMware By…
Recommended action: Upgrade to 3.7.1, 3.6.14 or 3.5.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd/v3 >= 3.6.0, <= 3.6.10; >= 3.5.0, <= 3.5.29
Fixed in
3.6.113.5.30· Vendor fix available
Issue
Impact What kind of vulnerability is it? Who is impacted? A vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. Kubernetes does not rely on etcd’s built-in authentication and authorization. Instead, the API server handles authentication and authorization itself, so typical Kubernetes deployments are not affected. Patches Has the problem been patched? What versions should users upgrade to? This vulnerability is patched in the following versions: - etcd 3.6.11 - etcd 3.5.30 - etcd 3.4.44 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? If upgrading is not immediately possible, reduce exposure by treating the affected RPCs as unauthenticated in…
Recommended action: Upgrade to 3.6.11 or 3.5.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd/v3 >= 3.4.0-rc.0, <= 3.4.9; < 3.3.23
Fixed in
3.3.233.4.10· Vendor fix available
Issue
Vulnerability type Logging Detail etcd users who have no password can authenticate only through a client certificate. When such users try to authenticate into etcd using the Authenticate endpoint, errors are logged with insufficient information regarding why the authentication failed, and may be misleading when auditing etcd logs. References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 3.4.10 or 3.3.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd/v3 >= 3.4.0-rc.0, <= 3.4.9; < 3.3.23
Fixed in
3.3.233.4.10· Vendor fix available
Issue
Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 3.4.10 or 3.3.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd/v3 >= 3.4.0-rc.0, <= 3.4.9; < 3.3.23
Fixed in
3.3.233.4.10· Vendor fix available
Issue
Vulnerability type Cryptography Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail Secure endpoint validation is performed by the etcd gateway start command when the --discovery-srv flag is enabled. However, as currently implemented, it only validates TCP reachability, effectively allowing connections to an endpoint that doesn't accept TLS connections through the HTTPS URL. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward. References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 3.4.10 or 3.3.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd/v3 >= 3.4.0, < 3.4.10; < 3.3.23
Fixed in
3.3.233.4.10· Vendor fix available
Issue
Vulnerability type Authentication Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates the detected endpoints once. Therefore, if an endpoint changes its authentication settings, the gateway will continue to assume the endpoint is still authenticated. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward. References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 3.4.10 or 3.3.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd/v3 < 3.3.23; >= 3.4.0, < 3.4.10
Fixed in
3.3.233.4.10· Vendor fix available
Issue
Vulnerability type Data Validation Detail In the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry. References Find out more on this vulnerability in the security audit report For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Recommended action: Upgrade to 3.4.10 or 3.3.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go go.etcd.io/etcd/v3 >= 3.2.0, < 3.2.26; >= 3.3.0, < 3.3.11
Fixed in
3.2.263.3.11· Vendor fix available
Issue
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Recommended action: Upgrade to 3.3.11 or 3.2.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.
Recommended action: Upgrade to 3.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.