Lucene search

PRIOn knowledge basePRION:CVE-2023-32082

HistoryMay 11, 2023 - 8:15 p.m.

Code injection

2023-05-1120:15:00

PRIOn knowledge base

www.prio-n.com

etcd

leasetimetolive

code injection

key-value store

distributed system

rbac

auth

security issue

fix

nvd

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.4%

JSON

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn’t have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

CPENameOperatorVersion
etcdge3.5.0
etcdlt3.5.9
etcdlt3.4.26

Name	Operator	Version
etcd	ge	3.5.0
etcd	lt	3.5.9
etcd	lt	3.4.26

References

github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md

github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md

github.com/etcd-io/etcd/pull/15656

github.com/etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298