Lucene search

GoogleOSV:CVE-2020-15136

HistoryAug 06, 2020 - 11:15 p.m.

CVE-2020-15136

2020-08-0623:15:11

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.2%

JSON

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

CPENameOperatorVersion
etcdeq3.4.7
etcdeq3.4.5
etcdeq3.4.0
etcdeq3.4.6
etcdeq3.4.1
etcdeq3.4.8
etcdeq3.4.9
etcdeq3.4.2
etcdeq3.4.4
etcdeq3.4.3

Name	Operator	Version
etcd	eq	3.4.7
etcd	eq	3.4.5
etcd	eq	3.4.0
etcd	eq	3.4.6
etcd	eq	3.4.1
etcd	eq	3.4.8
etcd	eq	3.4.9
etcd	eq	3.4.2
etcd	eq	3.4.4
etcd	eq	3.4.3

References

github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md

github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/