요약
- CVE-2023-32082은(는) github.com/etcd-io/etcd, etcd (etcd)에 영향을 주는 보통 (CVSS 4.3) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.74%, 전체 취약점의 54.9%보다 높음.
- 조치: 3.5.9, 3.4.26 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| github.com/etcd-io/etcd Go | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
| etcd | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
Description
Impact
LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).
Patches
< v3.4.26 and < v3.5.9 are affected.
Workarounds
No.
Reporter
Yoni Rozenshein
NVD description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
github.com/etcd-io/etcd의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free