1066 matches found
CVE-2023-39325 affecting package etcd for versions less than 3.5.6-11
CVE-2023-39325 affecting package etcd for versions less than 3.5.6-11. A patched version of the package is available...
conmon security update
conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.26.4-1 - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org/x/net to v0.17.0 cri-tools 1.26.1-4 -...
conmon security update
conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.26.4-1 - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org/x/net to v0.17.0 cri-tools 1.26.1-4 -...
BIT-ETCD-2020-15106 Improper Input Validation in etcd
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentional...
BIT-ETCD-2020-15112 Improper Input Validation in etcd
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime...
BIT-ETCD-2020-15113 Improper Preservation of Permissions in etcd
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...
BIT-ETCD-2021-28235
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function...
BIT-ETCD-2022-34038
Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability...
BIT-ETCD-2023-32082 etcd key name can be accessed via LeaseTimeToLive API
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...
AZL-35644 CVE-2024-24786 affecting package etcd for versions less than 3.5.12-2
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
AZL-35563 CVE-2024-24786 affecting package etcd for versions less than 3.5.12-6
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
Insecure Transport
go.etcd.io/etcd/client/pkg/v3 is vulnerable to Insecure Transport. The vulnerability is due to default weak ciphers configuration...
Improper Certificate Validation
go.etcd.io/etcd is vulnerable to Improper Certificate Validation. The vulnerability is due to etcd gateway's handling of endpoint validation when the --discovery-srv flag is enabled, because it only checks for TCP reachability without ensuring that the endpoint accepted TLS connections through...
Inaccurate Logging
go.etcd.io/etcd is vulnerable to Inaccurate Logging. The vulnerability is due to errors being logged with insufficient information regarding why the authentication failed. This may be misleading while auditing etcd logs...
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only
Vulnerability type Logging Detail etcd users who have no password can authenticate only through a client certificate. When such users try to authenticate into etcd using the Authenticate endpoint, errors are logged with insufficient information regarding why the authentication failed, and may be...
GHSA-VJG6-93FV-QV64 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only
Vulnerability type Logging Detail etcd users who have no password can authenticate only through a client certificate. When such users try to authenticate into etcd using the Authenticate endpoint, errors are logged with insufficient information regarding why the authentication failed, and may be...
Etcd embed auto compaction retention negative value causing a compaction loop or a crash
Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in...
GHSA-PM3M-32R3-7MFH Etcd embed auto compaction retention negative value causing a compaction loop or a crash
Impact Data Validation Detail The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs. References Find out more on this vulnerability in...
GHSA-5X4G-Q5RC-36JP Etcd pkg Insecure ciphers are allowed by default
Vulnerability type Cryptography Detail The TLS ciphers list supported by etcd contains insecure cipher suites. Users can configure the desired ciphers using the “--cipher-suites” flag, and a default list of secure cipher suites is used if empty. Workarounds By default, no action is required. If...
Etcd pkg Insecure ciphers are allowed by default
Vulnerability type Cryptography Detail The TLS ciphers list supported by etcd contains insecure cipher suites. Users can configure the desired ciphers using the “--cipher-suites” flag, and a default list of secure cipher suites is used if empty. Workarounds By default, no action is required. If...