Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-07BBE6911CDAD8CE87C356FD8FFF8C45Missing Authentication for Critical Function
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
7.1 High
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
54.2%
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
| CPE | Name | Operator | Version |
|---|---|---|---|
| go/go.etcd.io/etcd | lt | 3.3.23 | |
| go/go.etcd.io/etcd | ge | 3.4.0-rc.0 | |
| go/go.etcd.io/etcd | le | 3.4.9 |
References
github.com/advisories/GHSA-wr2v-9rpq-c35q
github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md
github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
lists.fedoraproject.org/archives/list/[email protected]/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
nvd.nist.gov/vuln/detail/CVE-2020-15136
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
7.1 High
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
54.2%