Lucene search
GitHub Advisory DatabaseGHSA-3P4G-RCW5-8298HistoryMay 12, 2023 - 8:19 p.m.
etcd Key name can be accessed via LeaseTimeToLive API
2023-05-1220:19:50
CWE-200
GitHub Advisory Database
github.com
21
etcd
leasetimetolive api
key names
rbac
limited impact
version 3.4.26
version 3.5.9
yoni rozenshein
software
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.001
Percentile
39.2%
Impact
LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn’t have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).
Patches
< v3.4.26 and < v3.5.9 are affected.
Workarounds
No.
Reporter
Yoni Rozenshein
Affected configurations
Node
etcd-ioetcdRange3.5.0–3.5.9
ORetcd-ioetcdRange<3.4.26
References
Related
cbl_mariner
cbl_mariner
CVE-2023-32082 affecting package etcd for versions less than 3.5.3-10
2023-02-14 20:24:03
prion
prion
Code injection
2023-05-11 20:15:00
nvd
nvd
CVE-2023-32082
2023-05-11 20:15:09
veracode
veracode
Information Disclosure
2023-05-17 05:21:49
nessus
nessus
Photon OS 4.0: Etcd PHSA-2023-4.0-0398
2024-07-23 00:00:00
Photon OS 5.0: Etcd PHSA-2023-5.0-0012
2024-07-24 00:00:00
Photon OS 4.0: Coredns PHSA-2023-4.0-0505
2024-07-24 00:00:00
ubuntucve
ubuntucve
CVE-2023-32082
2023-05-11 00:00:00
osv
osv
BIT-etcd-2023-32082
2024-03-06 10:51:44
CVE-2023-32082
2023-05-11 20:15:09
etcd Key name can be accessed via LeaseTimeToLive API
2023-05-12 20:19:50
openvas
openvas
cvelist
cvelist
CVE-2023-32082 etcd key name can be accessed via LeaseTimeToLive API
2023-05-11 19:22:56
redhatcve
redhatcve
CVE-2023-32082
2023-05-18 04:27:32
debiancve
debiancve
CVE-2023-32082
2023-05-11 20:15:09
cve
cve
CVE-2023-32082
2023-05-11 20:15:09
photon
photon
Moderate Photon OS Security Update - PHSA-2023-5.0-0012
2023-05-26 00:00:00
Moderate Photon OS Security Update - PHSA-2023-4.0-0398
2023-05-25 00:00:00
Moderate Photon OS Security Update - PHSA-2023-3.0-0586
2023-05-25 00:00:00
redhat
redhat
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.001
Percentile
39.2%
Related for GHSA-3P4G-RCW5-8298