PT-2018-10222 · Coreos+3 · Etcd+3

Zelivans · Publicado 2018-04-03 · Atualizado 2023-02-13 · CVE-2018-1098

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions etcd versions 3.3.1 and earlier

Description A cross-site request forgery flaw was found, allowing an attacker to set up a website that tries to send a POST request to the etcd server and modify a key. Since adding a key is done with PUT, it is theoretically safe, but POST allows creating in-order keys that an attacker can send.

Recommendations For etcd versions 3.3.1 and earlier, consider disabling the POST request functionality to the etcd server as a temporary workaround until a patch is available. Restrict access to the etcd server to minimize the risk of exploitation. Avoid using the POST method in the affected API endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

ALT-PU-2020-1882

ALT-PU-2020-2176

CVE-2018-1098

GHSA-5GJM-FJ42-X983

Produtos afetados

Alt Linux

Astra Linux

Debian

Etcd

Referências · 28

• 🔥 https://github.com/coreos/etcd/issues/9353 · Exploit
• https://github.com/coreos/etcd/commit/a7e5790c82039945639798ae9a3289fe787f5e56 · Nota
• https://github.com/etcd-io/etcd/issues/10479 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1552714 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1098 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS · Aviso do Fabricante
• https://packages.debian.org/src:etcd · Nota
• https://cve.org/CVERecord?id=CVE-2018-1098 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5gjm-fj42-x983 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02944 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1099 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2018-1098 · Nota