Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Etcd | Etcd | 3.4.10 (including) | 3.4.10 (including) |
| Red Hat OpenStack Platform 16.1 | RedHat | etcd-0:3.3.23-14.el8ost | * |
| Red Hat OpenStack Platform 16.2 | RedHat | etcd-0:3.3.23-14.el8ost | * |
| Red Hat OpenStack Platform 17.0 | RedHat | etcd-0:3.4.26-1.el9ost | * |
| Etcd | Ubuntu | bionic | * |
| Etcd | Ubuntu | esm-apps/bionic | * |
| Etcd | Ubuntu | esm-apps/focal | * |
| Etcd | Ubuntu | esm-apps/jammy | * |
| Etcd | Ubuntu | focal | * |
| Etcd | Ubuntu | jammy | * |
| Etcd | Ubuntu | kinetic | * |
| Etcd | Ubuntu | lunar | * |
| Etcd | Ubuntu | mantic | * |
| Etcd | Ubuntu | oracular | * |
| Etcd | Ubuntu | plucky | * |
| Etcd | Ubuntu | trusty | * |
| Etcd | Ubuntu | upstream | * |
| Etcd | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- http://etcd.com
- https://github.com/etcd-io/etcd
- https://github.com/etcd-io/etcd/pull/15648
- https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png
- https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png
- http://etcd.com
- https://github.com/etcd-io/etcd
- https://github.com/etcd-io/etcd/pull/15648
- https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png
- https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png
