要点
- CVE-2023-32082 是影响 github.com/etcd-io/etcd, etcd (etcd) 的中危 (CVSS 4.3)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.74%，高于 54.9% 的漏洞。
- 修复：升级到 3.5.9, 3.4.26 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| github.com/etcd-io/etcd Go | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
| etcd | ≥ 3.5.0, < 3.5.9< 3.4.26
| 3.5.93.4.26
|
Description
Impact
LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).
Patches
< v3.4.26 and < v3.5.9 are affected.
Workarounds
No.
Reporter
Yoni Rozenshein
NVD description
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
github.com/etcd-io/etcd 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free