In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the –endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Etcd | Redhat | 3.3.0 (including) | 3.3.23 (excluding) |
| Etcd | Redhat | 3.4.0 (including) | 3.4.10 (excluding) |
| Red Hat OpenShift Container Platform 4.8 | RedHat | openshift4/ose-etcd:v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream | * |
| Red Hat OpenStack Platform 16.1 | RedHat | etcd-0:3.3.23-1.el8ost | * |
| Etcd | Ubuntu | bionic | * |
| Etcd | Ubuntu | focal | * |
| Etcd | Ubuntu | groovy | * |
| Etcd | Ubuntu | hirsute | * |
| Etcd | Ubuntu | impish | * |
| Etcd | Ubuntu | kinetic | * |
| Etcd | Ubuntu | lunar | * |
| Etcd | Ubuntu | mantic | * |
| Etcd | Ubuntu | oracular | * |
| Etcd | Ubuntu | plucky | * |
| Etcd | Ubuntu | trusty | * |
| Etcd | Ubuntu | upstream | * |
| Etcd | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md
- https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
- https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md
- https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/