CVE-2020-15115
published 2020-08-06CVE-2020-15115: etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.34%
68.1th percentile
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | etcd | < etcd 3.3.25+dfsg-5 (bookworm) | etcd 3.3.25+dfsg-5 (bookworm) |
| etcd-io | etcd | < 3.3.23 | 3.3.23 |
| etcd-io | etcd | < 3.4.10 | 3.4.10 |
| etcd | etcd | >= 0 < 3.3.25+dfsg-5 | 3.3.25+dfsg-5 |
| etcd | etcd | >= 0 < 3.3.25+dfsg-5 | 3.3.25+dfsg-5 |
| etcd | etcd | >= 0 < 3.3.25+dfsg-5 | 3.3.25+dfsg-5 |
| etcd | etcd | >= 0 < 3.3.25+dfsg-5 | 3.3.25+dfsg-5 |
| fedoraproject | fedora | — | — |
| go.etcd.io | etcd_client_v3 | >= 0 < 3.3.23 | 3.3.23 |
| go.etcd.io | etcd_client_v3 | >= 3.4.0 < 3.4.10 | 3.4.10 |
| msrc | cbl2_etcd_3.5.0-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | etcd | >= 3.3.0 < 3.3.23 | 3.3.23 |
| redhat | etcd | >= 3.4.0 < 3.4.10 | 3.4.10 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_msrc7.5HIGH
vendor_debian5.8MEDIUM
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
No minimum password length in etcd
vendor_msrc·2020-08-11·CVSS 7.5
CVE-2020-15115 [MEDIUM] CWE-521 No minimum password length in etcd
No minimum password length in etcd
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/
Red Hat
etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords
vendor_redhat·2020-08-05·CVSS 5.8
CVE-2020-15115 [MEDIUM] CWE-305 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords
etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
A flaw was found in etcd, where it does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This flaw allows an attacker to guess or brute-force users' passwords with little computational effort. The highest threat from this vulnerability is to confidentiality.
Statement: Red Hat OpenShift Container Platform (RHOCP) doesn't use etcd role-based access control (rbac)
Debian
CVE-2020-15115: etcd - etcd before versions 3.3.23 and 3.4.10 does not perform any password length vali...
vendor_debian·2020·CVSS 5.8
CVE-2020-15115 [MEDIUM] CVE-2020-15115: etcd - etcd before versions 3.3.23 and 3.4.10 does not perform any password length vali...
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
Scope: local
bookworm: resolved (fixed in 3.3.25+dfsg-5)
bullseye: resolved (fixed in 3.3.25+dfsg-5)
forky: resolved (fixed in 3.3.25+dfsg-5)
sid: resolved (fixed in 3.3.25+dfsg-5)
trixie: resolved (fixed in 3.3.25+dfsg-5)
OSV
etcd has no minimum password length
osv·2022-10-06
CVE-2020-15115 [MEDIUM] etcd has no minimum password length
etcd has no minimum password length
### Vulnerability type
Access Control
### Workarounds
The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. [It is the responsibility of the administrator to enforce these requirements](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md#notes-on-password-strength).
### Detail
etcd does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users’ passwords with little computational effort.
### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDI
GHSA
etcd has no minimum password length
ghsa·2022-10-06
CVE-2020-15115 [MEDIUM] CWE-521 etcd has no minimum password length
etcd has no minimum password length
### Vulnerability type
Access Control
### Workarounds
The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. [It is the responsibility of the administrator to enforce these requirements](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md#notes-on-password-strength).
### Detail
etcd does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users’ passwords with little computational effort.
### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDI
OSV
CVE-2020-15115: etcd before versions 3
osv·2020-08-06·CVSS 7.5
CVE-2020-15115 [HIGH] CVE-2020-15115: etcd before versions 3
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords [fedora-all]
bugzilla·2020-08-14·CVSS 5.8
CVE-2020-15115 [MEDIUM] CVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords [fedora-all]
CVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE
Bugzilla
CVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords
bugzilla·2020-08-14·CVSS 5.8
CVE-2020-15115 [MEDIUM] CVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords
CVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords
In etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
References:
https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh
Discussion:
Created etcd tracking bugs for this issue:
Affects: fedora-all [bug 1868879]
---
External References:
https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh
---
FTR ocp 3.x and 4.x do not use etcd internal RBAC so exposure would only be RHEL7 use cases outside of OpenShift.
---
No patch was de
https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hhhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hhhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
2020-08-06
Published