Insecure Permission Checks

2020-08-0606:08:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

12.6%

JSON

github.com/etcd-io/etcd does not properly perform permission checks. The function os.MkdirAll that creates the directory containing automatically generated self-signed certificates for TLS connections with clients is insecure and does not perform any permission checks, potentially overwriting existing folders.

CPENameOperatorVersion
github.com/etcd-io/etcdle3.4.9
github.com/etcd-io/etcdle3.3.22
etcdeq3.2.21__2.el8
etcdeq3.2.21__2.el8ost
github.com/etcd-io/etcdle3.4.9
github.com/etcd-io/etcdle3.3.22
etcdeq3.2.21__2.el8
etcdeq3.2.21__2.el8ost

Name	Operator	Version
github.com/etcd-io/etcd	le	3.4.9
github.com/etcd-io/etcd	le	3.3.22
etcd	eq	3.2.21__2.el8
etcd	eq	3.2.21__2.el8ost
github.com/etcd-io/etcd	le	3.4.9
github.com/etcd-io/etcd	le	3.3.22
etcd	eq	3.2.21__2.el8
etcd	eq	3.2.21__2.el8ost