PT-2020-14216 · Coreos+1 · Etcd+1

Spzala · Published 2020-08-05 · Updated 2024-01-31 · CVE-2020-15136

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.4.10 etcd versions prior to 3.3.23

Description The issue concerns the gateway TLS authentication in etcd, which is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain. No authentication is performed against endpoints provided in the --endpoints flag. This occurs in the discoverEndpoints function.

Recommendations For etcd versions prior to 3.4.10, update to version 3.4.10 or later to resolve the issue. For etcd versions prior to 3.3.23, update to version 3.3.23 or later to resolve the issue. As a temporary workaround, consider restricting the use of the --endpoints flag until a patch is applied, and rely on endpoints identified in DNS SRV records for TLS authentication. Refer to the etcd gateway documentation for more information on secure configuration and endpoint validation.

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

ALT-PU-2020-2736

ALT-PU-2021-1544

ALT-PU-2022-1247

AZL-6393

CVE-2020-15136

GHSA-WR2V-9RPQ-C35Q

RHSA-2021:0916

Affected Products

Alt Linux

Etcd

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15136 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wr2v-9rpq-c35q · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15136 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15136 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15136 · Security Note
• https://osv.dev/vulnerability/AZL-6393 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15136 · Vendor Advisory
• https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q · Note
• https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15136 · Note