CVE-2018-16886: go.etcd.io/etcd Authentication Bypass – CVSS 8.1 · Watchpost

← 脆弱性一覧

go.etcd.io/etcd Authentication Bypass

高 8.1CVE-2018-16886 · GHSA-h6xx-pmxh-3wgp · GO-2021-0077 · 14/01/2019 公開 · 17/06/2026 更新

要点

CVE-2018-16886 は go.etcd.io/etcd, go.etcd.io/etcd/v3, etcd (etcd) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.1%（全脆弱性の 90.7% より高い）。
対処：0.5.0-alpha.5.0.20190108173120-83c051b701d3, 3.2.26, 3.3.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
go.etcd.io/etcd Go	`< 0.5.0-alpha.5.0.20190108173120-83c051b701d3`	`0.5.0-alpha.5.0.20190108173120-83c051b701d3`
go.etcd.io/etcd/v3 Go	`≥ 3.2.0, < 3.2.26≥ 3.3.0, < 3.3.11`	`3.2.263.3.11`
etcd etcd	`≥ 3.2.0, < 3.2.26≥ 3.3.0, < 3.3.11`	`3.2.263.3.11`

概要

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

NVD の説明

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

参考情報

nvd.nist.gov/vuln/detail/CVE-2018-16886 · ADVISORY
etcd-io/etcd#10366 · WEB
etcd-io/etcd commit 0191509 · WEB
etcd-io/etcd commit bf9d0d8 · WEB
access.redhat.com/errata/RHSA-2019:0237 · WEB
access.redhat.com/errata/RHSA-2019:1352 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
etcd-io/etcd · PACKAGE
etcd-io/etcd · WEB
etcd-io/etcd · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4 · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS · WEB
pkg.go.dev/vuln/GO-2021-0077 · WEB
securityfocus.com/bid/106540 · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS

go.etcd.io/etcd のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン