Skip to content
OpenAdvisories
Critical RHSA-2023:3441 2 CVEs

Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (etcd) security update

Published Sep 18, 2024 · Updated Aug 20, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenStack 17 openstack:17.0::el9 etcd 0:3.4.26-1.el9ost
Red Hat · OpenStack 17 openstack:17.0::el9 etcd-debuginfo 0:3.4.26-1.el9ost
Red Hat · OpenStack 17 openstack:17.0::el9 etcd-debugsource 0:3.4.26-1.el9ost

Vulnerabilities 2

  • Critical 9.8
    CVE-2021-28235 Public exploit

    Etcd-io Improper Authentication vulnerability

    Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

    etcd etcd etcd go.etcd.io/etcd/v3 Debian Ubuntu Azure Linux Go
  • Low 3.1
    CVE-2023-32082

    etcd key name can be accessed via LeaseTimeToLive API

    etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read p…

    etcd-io etcd etcd etcd Debian Ubuntu Azure Linux Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2184441
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2208131
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3441.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-28235
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-28235
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-28235
  • report
    https://access.redhat.com/security/cve/CVE-2023-32082
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-32082
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-32082