CVE-2020-15115

2020-08-0600:00:00

ubuntu.com

0.002 Low

EPSS

Percentile

54.7%

JSON

etcd before versions 3.3.23 and 3.4.10 does not perform any password length
validation, which allows for very short passwords, such as those with a
length of one. This may allow an attacker to guess or brute-force users’
passwords with little computational effort.

Notes

Author	Note
ebarretto	No fix available: The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. It is the responsibility of the administrator to enforce these requirements.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchetcd< anyUNKNOWN
ubuntu20.04noarchetcd< anyUNKNOWN
ubuntu22.04noarchetcd< anyUNKNOWN
ubuntu23.10noarchetcd< anyUNKNOWN
ubuntu24.04noarchetcd< anyUNKNOWN
ubuntu16.04noarchetcd< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	etcd	< any	UNKNOWN
ubuntu	20.04	noarch	etcd	< any	UNKNOWN
ubuntu	22.04	noarch	etcd	< any	UNKNOWN
ubuntu	23.10	noarch	etcd	< any	UNKNOWN
ubuntu	24.04	noarch	etcd	< any	UNKNOWN
ubuntu	16.04	noarch	etcd	< any	UNKNOWN