etcd Key name can be accessed via LeaseTimeToLive API

中 4.3CVE-2023-32082 · BIT-etcd-2023-32082 · GHSA-3p4g-rcw5-8298 · 11/05/2023 公開 · 17/06/2026 更新

要点

CVE-2023-32082 は github.com/etcd-io/etcd, etcd (etcd) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.74%（全脆弱性の 54.8% より高い）。
対処：3.5.9, 3.4.26 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/etcd-io/etcd Go	`≥ 3.5.0, < 3.5.9< 3.4.26`	`3.5.93.4.26`
etcd etcd	`≥ 3.5.0, < 3.5.9< 3.4.26`	`3.5.93.4.26`

概要

Impact

LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).

Patches

< v3.4.26 and < v3.5.9 are affected.

Workarounds

No.

Reporter

Yoni Rozenshein

NVD の説明

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.