CVE-2020-15136

Description

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
• v2.0•MEDIUM•Score: 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS Trends

Current EPSS score: 0.31%• Percentile: 54%

Techniques & Countermeasures

• CWE-306•Missing Authentication for Critical Function

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

• CWE-287•Improper Authentication

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

• etcd-io•etcd

  ≥ 3.4.0, < 3.4.10 | < 3.3.23

• fedoraproject•fedora

  32

• go.etcd.io•etcd

  ≥ 3.4.0-rc.0, < 3.4.10 | < 3.3.23

• redhat•etcd

  ≥ 3.3.0, < 3.3.23 | ≥ 3.4.0, < 3.4.10

References (5)

• https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
• https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
• https://nvd.nist.gov/vuln/detail/CVE-2020-15136
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP