CVE-2020-15136 — Improper Authentication in Etcd

CWE-287 — Improper AuthenticationCWE-306 — Missing Authentication for Critical Function10 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 45.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Etcd-io EtcdEtcdGo.etcd.io Etcd+2 more
Timeline
PublishedAug 6
Latest updateJan 31

Description

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functional…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NExploitability: 2.2 | Impact: 4.2

Affected Packages4 packages

▶NVDredhat/etcd3.3.0 — 3.3.23+1
▶CVEListV5etcd-io/etcd< 3.3.23+1
▶Gogo.etcd.io/etcd3.4.0-rc.0 — 3.4.10+1
▶Debianetcd/etcd< 3.3.25+dfsg-5+3

Also affects: Fedora 32

🔴Vulnerability Details

4
GHSA
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records↗2024-01-31
▶
OSV
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records↗2024-01-31
▶
CVEList
Improper authentication in etcd↗2020-08-06
▶
OSV
CVE-2020-15136: In ectd before versions 3↗2020-08-06
▶

📋Vendor Advisories

3
Microsoft
Improper authentication in etcd↗2020-08-11
▶
Red Hat
etcd: no authentication is performed against endpoints provided in the --endpoints flag↗2020-08-05
▶
Debian
CVE-2020-15136: etcd - In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only ap...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-15136 etcd: no authentication is performed against endpoints provided in the --endpoints flag [fedora-all]↗2020-08-14
▶
Bugzilla
CVE-2020-15136 etcd: no authentication is performed against endpoints provided in the --endpoints flag↗2020-08-14
▶
CVE-2020-15136 — Improper Authentication in Etcd | cvebase