PT-2020-14195 · Coreos+3 · Etcd+3

Spzala · Published 2020-08-05 · Updated 2024-03-06 · CVE-2020-15113

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions etcd versions 3.3.23 and earlier etcd versions 3.4.10 and earlier

Description The issue concerns the creation of certain directory paths with restricted access permissions by using the os.MkdirAll function, which does not perform permission checks when a given directory path exists already. This affects the etcd data directory and the directory path used for automatically generating self-signed certificates for TLS connections with clients.

Recommendations For etcd versions 3.3.23 and earlier, ensure the directories have the desired permission (700) as a workaround. For etcd versions 3.4.10 and earlier, ensure the directories have the desired permission (700) as a workaround.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

ALT-PU-2020-2736

ALT-PU-2021-1544

ALT-PU-2022-1247

AZL-6390

BIT-ETCD-2020-15113

CVE-2020-15113

GHSA-CHH6-PPWQ-JH92

RHSA-2021:0916

USN-5628-1

USN-5628-2

Affected Products

Alt Linux

Linuxmint

Ubuntu

Etcd

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2020-15113 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15113 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15112 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-chh6-ppwq-jh92 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-etcd-2020-15113 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5628-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5628-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15113 · Security Note
• https://ubuntu.com/security/CVE-2020-15114 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5628-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5628-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15106 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15113 · Vendor Advisory