CVE-2020-15136
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records.
Does this matter?
Lower severity and a low EPSS score (1.64%). Track it; it rarely justifies an emergency change on its own.
Description
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- EPSS
- 1.64% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287, CWE-306
- Affected
- redhat/etcd · fedoraproject/fedora
- Source
- security-advisories@github.com
References
- https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.mdBroken Link
- https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35qThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
- https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.mdBroken Link
- https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35qThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.