Description
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Changed
Confidentiality: Low
Integrity: None
Availability: None
Affected Packages4 packages
▶Debianetcd< 3.3.25+dfsg-5+3 Also affects: Fedora 32
🔴Vulnerability Details
4OSVetcd has no minimum password length↗2022-10-06 GHSAetcd has no minimum password length↗2022-10-06 OSVCVE-2020-15115: etcd before versions 3↗2020-08-06 CVEListNo minimum password length in etcd↗2020-08-06 📋Vendor Advisories
3MicrosoftNo minimum password length in etcd↗2020-08-11 Red Hatetcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords↗2020-08-05 DebianCVE-2020-15115: etcd - etcd before versions 3.3.23 and 3.4.10 does not perform any password length vali...↗2020 💬Community
2BugzillaCVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords [fedora-all]↗2020-08-14 BugzillaCVE-2020-15115 etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords↗2020-08-14