Improper authentication in etcd
Published Aug 6, 2020
6.5
MEDIUMCVSS 3.1
EPSS 1.64%
Description
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
Affected products
-
- Version < 3.3.23StatusaffectedConstraints-
- Version >= 3.4.0, < 3.4.10StatusaffectedConstraints-
- Version
No data.
Red Hat OpenShift Container Platform 4.8
openshift4/ose-etcd:v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream
Fixed · RHSA-2021:2438
Red Hat OpenStack Platform 16.1
etcd-0:3.3.23-1.el8ost
Fixed · RHSA-2021:0916
Red Hat Advanced Cluster Management for Kubernetes 2
etcd
Not affected
Red Hat Enterprise Linux 7
etcd
Will not fix
Red Hat OpenStack Platform 15 (Stein)
etcd
Fix deferred
Red Hat Storage 3
etcd
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 4.8 | openshift4/ose-etcd:v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream | Fixed | RHSA-2021:2438 |
| Red Hat OpenStack Platform 16.1 | etcd-0:3.3.23-1.el8ost | Fixed | RHSA-2021:0916 |
| Red Hat Advanced Cluster Management for Kubernetes 2 | etcd | Not affected | n/a |
| Red Hat Enterprise Linux 7 | etcd | Will not fix | n/a |
| Red Hat OpenStack Platform 15 (Stein) | etcd | Fix deferred | n/a |
| Red Hat Storage 3 | etcd | Will not fix | n/a |
go.etcd.io/etcd
Go
Introduced 3.4.0-rc.0 Fixed 3.4.10go.etcd.io/etcd
Go
Introduced 0 Fixed 3.3.23
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | go.etcd.io/etcd | 3.4.0-rc.0 | 3.4.10 |
| Go | go.etcd.io/etcd | 0 | 3.3.23 |
Remediation
Red Hat statement
In Red Hat OpenShift Container Platform (RHOCP) the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable etcd to authenticated users only, therefore the impact by this vulnerability is Low. A similar access restriction is in place in Red Hat OpenStack Platform (RHOSP) as etcd is limited to use within the internal API network, which is not accessible to any OpenStack tenants. Additionally, RHOSP does not use the etcd gateway.
References (9)
- https://access.redhat.com/security/cve/CVE-2020-15136 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1868880 Issue Tracking
- https://github.com/advisories/GHSA-wr2v-9rpq-c35q Advisory
- https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md x_refsource_MISCBroken Link
- https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q x_refsource_CONFIRMThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
- https://nvd.nist.gov/vuln/detail/CVE-2020-15136
- https://www.cve.org/CVERecord?id=CVE-2020-15136
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-15136 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1868880 | Issue Tracking | |
| https://github.com/advisories/GHSA-wr2v-9rpq-c35q | Advisory | |
| https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md | x_refsource_MISCBroken Link | |
| https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q | x_refsource_CONFIRMThird Party Advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/ | vendor-advisoryx_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/ | ||
| https://nvd.nist.gov/vuln/detail/CVE-2020-15136 | ||
| https://www.cve.org/CVERecord?id=CVE-2020-15136 |
Change history (0)
No recorded changes yet.