En resumen
- CVE-2023-32082 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a github.com/etcd-io/etcd, etcd (etcd).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.74%, mayor que el 54.8% de las vulnerabilidades.
- Solución: actualizar a 3.5.9, 3.4.26 o posterior.
| Package | Affected versions | Patched versions |
|---|
| github.com/etcd-io/etcd Go | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
| etcd | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
Description
Impact
LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).
Patches
< v3.4.26 and < v3.5.9 are affected.
Workarounds
No.
Reporter
Yoni Rozenshein
NVD description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Más vulnerabilidades de github.com/etcd-io/etcd
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free