go.etcd.io/etcd

5 results · Clear filters · Feed

• Medium —
  GHSA-j86v-2vjr-fg8f

  Etcd Gateway TLS endpoint validation only confirms TCP reachability

  ### Vulnerability type Cryptography ### Workarounds Refer to the [gateway documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md). The vulnerability was spotted due to unclear documentation of how the gateway handles endp…

  go.etcd.io/etcd/v3 go.etcd.io/etcd Go
  Feb 3, 2024
• Medium 6.5
  CVE-2020-15136

  Improper authentication in etcd

  In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, w…

  etcd-io etcd dgraph etcd Debian Ubuntu Azure Linux Wolfi Go
  Aug 6, 2020
• Medium 6.5
  CVE-2020-15106

  Improper Input Validation in etcd

  In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely l…

  etcd-io etcd etcd etcd Debian Ubuntu Azure Linux Go
  Aug 5, 2020
• Medium 6.8
  CVE-2018-16886

  go.etcd.io/etcd Authentication Bypass

  etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) wh…

  The etcd Project etcd: etcd etcd Debian Ubuntu Go
  Jan 14, 2019
• Medium 5.5
  CVE-2018-1099

  DNS Rebinding in etcd

  DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

  Red Hat etcd dgraph etcd Debian Ubuntu Wolfi Go
  Apr 3, 2018