CVE Vulnerability

CVE-2020-15136

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

5.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 4.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q Third Party Advisory
https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md Broken Link
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/ Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:redhat:etcd:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:etcd:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Information

Published : 2020-08-06 11:15

Updated : 2021-11-18 06:31

NVD link : CVE-2020-15136

Mitre link : CVE-2020-15136

Products Affected
No products.
CWE
CWE-306