PT-2023-23594 · Etcd+3 · Etcd+3

Yoni Rozenshein · Published 2023-05-11 · Updated 2025-02-21 · CVE-2023-32082

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.4.26 and prior to 3.5.9

Description The issue is related to insufficient protection of service data in etcd, a distributed key-value store. The LeaseTimeToLive API allows access to key names associated with a lease when the Keys parameter is true, even if a user does not have read permission to the keys. This issue is limited to clusters that enable authentication (RBAC).

Recommendations For versions prior to 3.4.26, update to version 3.4.26 or later. For versions prior to 3.5.9, update to version 3.5.9 or later. As a temporary workaround, consider disabling the LeaseTimeToLive API or restricting access to it until a patch is applied. Restrict access to the Keys parameter in the LeaseTimeToLive API to minimize the risk of exploitation.

Exploit

Fix

DoS

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2023-1897

ALT-PU-2023-1930

ALT-PU-2023-1931

ALT-PU-2023-2072

AZL-26666

BDU:2025-01413

BIT-ETCD-2023-32082

CVE-2023-32082

GHSA-3P4G-RCW5-8298

OESA-2025-1168

OESA-2025-1169

OESA-2025-1170

RHSA-2023:3441

Affected Products

Alt Linux

Debian

Red Os

Etcd

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32082.json · Exploit
• https://github.com/etcd-io/etcd/pull/15656 · Patch
• https://github.com/etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-32082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32082 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-32082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3064 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-32082 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41723 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-28235 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1168 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-26666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34038 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32082 · Vendor Advisory