CVE-2020-15113

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).

Weakness

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Affected Software

Name	Vendor	Start Version	End Version
Etcd	Etcd	*	3.3.23 (excluding)
Etcd	Etcd	3.4.0 (including)	3.4.10 (excluding)
Red Hat OpenShift Container Platform 4.8	RedHat	openshift4/ose-etcd:v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream	*
Red Hat OpenStack Platform 16.1	RedHat	etcd-0:3.3.23-1.el8ost	*
Etcd	Ubuntu	bionic	*
Etcd	Ubuntu	devel	*
Etcd	Ubuntu	esm-apps/bionic	*
Etcd	Ubuntu	esm-apps/focal	*
Etcd	Ubuntu	esm-apps/jammy	*
Etcd	Ubuntu	esm-apps/noble	*
Etcd	Ubuntu	esm-apps/xenial	*
Etcd	Ubuntu	focal	*
Etcd	Ubuntu	groovy	*
Etcd	Ubuntu	hirsute	*
Etcd	Ubuntu	impish	*
Etcd	Ubuntu	jammy	*
Etcd	Ubuntu	kinetic	*
Etcd	Ubuntu	lunar	*
Etcd	Ubuntu	mantic	*
Etcd	Ubuntu	noble	*
Etcd	Ubuntu	oracular	*
Etcd	Ubuntu	plucky	*
Etcd	Ubuntu	questing	*
Etcd	Ubuntu	trusty	*
Etcd	Ubuntu	upstream	*
Etcd	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-15113
CWE	https://cwe.mitre.org/data/definitions/281.html

Improper Preservation of Permissions

Weakness

Affected Software

References