Photon OS 1.0: Etcd PHSA-2020-1.0-0313

An update of the etcd package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0313. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139696;...

Photon OS 3.0: Etcd PHSA-2020-3.0-0126

An update of the etcd package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0126. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139698;...

Denial Of Service (DoS)

etcd is vulnerable to denial of service DoS. An attacker is allowed to include the gateway address as an endpoint, causing the endpoint to stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0313

An update of 'httpd', 'etcd' packages of Photon OS has been released...

Critical Photon OS Security Update - PHSA-2020-0313

Updates of 'httpd', 'etcd' packages of Photon OS have been released...

Photon OS 2.0: Etcd PHSA-2020-2.0-0272

An update of the etcd package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0272. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139608;...

CVE-2020-15115

A flaw was found in etcd, where it does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This flaw allows an attacker to guess or brute-force users' passwords with little computational effort. The highest threat from this...

CVE-2020-15136

A flaw was found in etcd. The gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No...

CVE-2020-15106

A flaw was found In etcd, where a large slice causes panic in the decodeRecord method. The size of a record is stored in the length field of a WAL file, and no additional validation is performed on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionall...

CVE-2020-15114

A flaw was found in etcd, where the etcd gateway is a simple TCP proxy that allows basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This issue results in a denial of service since the endpoint can become stuck in a loop of requesting itsel...

CVE-2020-15112

A flaw was found in etcd, where it is possible to have an entry index greater than the number of entries in the ReadAll method in wal/wal.go. This can cause issues when WAL entries are being read during consensus, as an arbitrary etcd consensus participant can go down from a runtime panic when...

CVE-2020-15113

A flaw was found in etcd. Certain directory paths are created with restricted access permissions 700 by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0272

An update of 'linux', 'etcd', 'linux-secure', 'linux-aws', 'linux-esx', 'httpd' packages of Photon OS has been released...

ETCD Authorization Issues Vulnerability

etcd is a key-value storage system for distributed systems written in the Go language. An authorization issue vulnerability exists in etcd versions prior to 3.4.10 and prior to 3.3.23. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a...

ETCD Resource Management Error Vulnerability

etcd is a key-value storage system for distributed systems written in the Go language. A resource management error vulnerability exists in etcd versions prior to 3.3.23 and 3.4.10. An attacker could exploit this vulnerability to cause a denial of service...

Important Photon OS Security Update - PHSA-2020-3.0-0126

Updates of 'etcd' packages of Photon OS have been released...

etcd account bursting vulnerability

etcd is a key-value storage system for distributed systems written in the Go language. A security vulnerability exists in etcd versions prior to 3.3.23 and 3.4.10, which stems from the program failing to perform any password length validation. An attacker could use this vulnerability to conduct a...

Important Photon OS Security Update - PHSA-2020-0126

Updates of 'etcd' packages of Photon OS have been released...

Missing Authentication

github.com/etcd-io/etcd does not perform TLS authentication. When starting a gateway for endpoints provided in the --endpoints flag, it does not handle the endpoints validation...

Sensitive Information Disclosure

etcd is vulnerable to sensitive information disclosure. Lack of password strength checking length, coexistence of numbers and alphabets, etc during the creation or updating of a user password allows an attacker to brute-force the password easily if an administrator does not enforce a requirement ...