CVE-2023-32082 — Sensitive Information Exposure in Etcd

CWE-200 — Sensitive Information Exposure8 documents7 sources
Severity
4.3MEDIUMNVD
CNA3.1
EPSS
0.2%
top 52.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Etcd-io EtcdEtcdGithub.com Etcd-io Etcd
Timeline
PublishedMay 11
Latest updateMay 12

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDetcd/etcd3.5.0 — 3.5.9+1
▶CVEListV5etcd-io/etcd< 3.4.26+1
▶Gogithub.com/etcd-io_etcd3.5.0 — 3.5.9+1
▶Debianetcd/etcd< 3.4.30-1+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
etcd Key name can be accessed via LeaseTimeToLive API↗2023-05-12
▶
GHSA
etcd Key name can be accessed via LeaseTimeToLive API↗2023-05-12
▶
OSV
CVE-2023-32082: etcd is a distributed key-value store for the data of a distributed system↗2023-05-11
▶
CVEList
etcd key name can be accessed via LeaseTimeToLive API↗2023-05-11
▶

📋Vendor Advisories

3
Red Hat
etcd: Key name can be accessed via LeaseTimeToLive API↗2023-05-11
▶
Microsoft
etcd key name can be accessed via LeaseTimeToLive API↗2023-05-09
▶
Debian
CVE-2023-32082: etcd - etcd is a distributed key-value store for the data of a distributed system. Prio...↗2023
▶
CVE-2023-32082 — Sensitive Information Exposure in Etcd | cvebase