Em resumo
- CVE-2023-32082 é uma vulnerabilidade MÉDIO (CVSS 4.3) que afeta github.com/etcd-io/etcd, etcd (etcd).
- Chance de exploração nos próximos 30 dias (EPSS): 0.74%, maior que 54.8% das vulnerabilidades.
- Correção: atualize para 3.5.9, 3.4.26 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| github.com/etcd-io/etcd Go | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
| etcd | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
Description
Impact
LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).
Patches
< v3.4.26 and < v3.5.9 are affected.
Workarounds
No.
Reporter
Yoni Rozenshein
NVD description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Mais vulnerabilidades de github.com/etcd-io/etcd
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free