CVE-2018-1099: fedoraproject fedora Improper Input Validation
CVSS: 5.5v3.0MediumModified
AliasesUBUNTU-CVE-2018-1099DEBIAN-CVE-2018-1099CGA-j29x-wmj9-c5ggCGA-mxpj-v6j2-g375CGA-phc9-97x3-wqwmCGA-q6qc-8v9v-5rc9CGA-q8pm-5jgw-5755CGA-w22p-xg5p-w835GHSA-wf43-55jj-vwq8CGA-5c5h-2gqw-cf59CGA-5h8g-fggf-67p3CGA-62gm-mh2c-j47jCGA-9xc7-3498-jvgfCGA-f4mr-65xr-v93fCGA-f82w-6cq3-p747CGA-hhjv-f558-6cm4CGA-m7p7-6rqw-c6q9CGA-p664-vx3q-6vhcCGA-v47x-vgc6-3g79
Published 03-04-2018Last modified 17-09-2024
Vulnerability summary
CVE-2018-1099 is a medium (CVSS 5.5) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.5/10
010
Medium · v3.0 (NVD)EPSS score
0.50%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 03-04-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
CVSS metrics
7 scores · 6 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · GoEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
0.00 pp
From 0.50% on 18-09-2026
18-09-202618-10-2026
EPSS score0.50%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundEtcd
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- dgraph< 23.1.0-r6
- etcd-3.4< 3.4.36-r1
- etcd-3.4-iamguarded-compat< 3.4.36-r1
- etcd-fips-3.4< 3.4.36-r1
- juicefs-1.2All versions (No fix recorded)
Wolfi3 products
- dgraph< 23.1.0-r6
- juicefs-1.3All versions (No fix recorded)
- juicefs-1.3-compatAll versions (No fix recorded)
Debian1 product
- etcd< 3.4.23-1
Fedoraproject1 product
- fedoraEOL30
Go.etcd.io1 product
- etcd< 3.4.0
Red hat, inc.1 product
- etcd3.3.1 and earlier
Redhat1 product
- etcd≤ 3.3.1
Ubuntu1 product
- etcdAll versions (No fix recorded)
8 vendors · 17 products
References
12 links- bugzilla.redhat.com/show_bug.cgi?id=1552717X Refsource CONFIRMIssue TrackingPatchVendor AdvisoryREPORTFIXWEB
