{"schemaVersion":3,"id":"SUSE-SU-2024:3656-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for etcd\n\nThis update for etcd fixes the following issues:\n\nUpdate to version 3.5.12:\n\nSecurity fixes:\n\n- CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)\n- CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)\n- CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)\n- CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)\n- CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)\n- CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)\n- CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)\n- CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)\n- CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)\n- CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)\n\nOther changes:\n\n- Added hardening to systemd service(s) (bsc#1181400)\n- Fixed static /tmp file issue (bsc#1199031)\n- Fixed systemd service not starting (bsc#1183703)\n\nFull changelog:\n\nhttps://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12","dates":{"published":"2024-10-16T11:33:42.000Z","modified":"2026-02-04T02:49:49.268Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"etcd&distro=openSUSE Leap 15.5","name":"etcd","label":"etcd&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/etcd&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 3.5.12-150000.7.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.5.12-150000.7.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"etcd&distro=openSUSE Leap 15.6","name":"etcd","label":"etcd&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/etcd&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 3.5.12-150000.7.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.5.12-150000.7.6.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243656-1/","label":"www.suse.com/support/update/announcement/2024/suse-su-20243656-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1095184","label":"bugzilla.suse.com/1095184","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1118897","label":"bugzilla.suse.com/1118897","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1118898","label":"bugzilla.suse.com/1118898","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1118899","label":"bugzilla.suse.com/1118899","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1121850","label":"bugzilla.suse.com/1121850","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1174951","label":"bugzilla.suse.com/1174951","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1181400","label":"bugzilla.suse.com/1181400","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1183703","label":"bugzilla.suse.com/1183703","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1199031","label":"bugzilla.suse.com/1199031","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1208270","label":"bugzilla.suse.com/1208270","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1208297","label":"bugzilla.suse.com/1208297","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1210138","label":"bugzilla.suse.com/1210138","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1213229","label":"bugzilla.suse.com/1213229","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1217070","label":"bugzilla.suse.com/1217070","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1217950","label":"bugzilla.suse.com/1217950","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1218150","label":"bugzilla.suse.com/1218150","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","label":"www.suse.com/security/cve/CVE-2018-16873","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","label":"www.suse.com/security/cve/CVE-2018-16874","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","label":"www.suse.com/security/cve/CVE-2018-16875","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16886","label":"www.suse.com/security/cve/CVE-2018-16886","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15106","label":"www.suse.com/security/cve/CVE-2020-15106","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15112","label":"www.suse.com/security/cve/CVE-2020-15112","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28235","label":"www.suse.com/security/cve/CVE-2021-28235","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","label":"www.suse.com/security/cve/CVE-2022-41723","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29406","label":"www.suse.com/security/cve/CVE-2023-29406","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","label":"www.suse.com/security/cve/CVE-2023-47108","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","label":"www.suse.com/security/cve/CVE-2023-48795","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2018-16873","CVE-2018-16874","CVE-2018-16875","CVE-2018-16886","CVE-2020-15106","CVE-2020-15112","CVE-2021-28235","CVE-2022-41723","CVE-2023-29406","CVE-2023-47108","CVE-2023-48795"],"downstream":[],"duplicates":[],"related":["CVE-2018-16873","CVE-2018-16874","CVE-2018-16875","CVE-2018-16886","CVE-2020-15106","CVE-2020-15112","CVE-2021-28235","CVE-2022-41723","CVE-2023-29406","CVE-2023-47108","CVE-2023-48795"]},"timeline":[{"kind":"published","date":"2024-10-16T11:33:42.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:49:49.268Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T04:45:44.927Z","stale":false,"partial":false}}