CVE-2021-28235

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

This has been fixed in v.3.5.8 and was also backported to 3.4 and 3.5.

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

%{expand:

Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

These are all security issues fixed in the etcd-3.5.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the etcd-for-k8s1.25-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the etcd-for-k8s1.26-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the etcd-for-k8s1.27-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed.

This update for etcd fixes the following issues:

Update to version 3.5.12:

• Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795
• test: fix TestHashKVWhenCompacting: ensure all goroutine finished
• print error log when creating peer listener failed
• mvcc: Printing etcd backend database related metrics inside scheduleCompaction function
• dependency: update go version to 1.20.13
• commit bbolt transaction if there is any pending deleting operations
• add tests to test tx delete consistency.
• Don't flock snapshot files
• Backport adding digest for etcd base image.
• Add a unit tests and missing flags in etcd help.
• Add missing flag in etcd help.
• Backport testutils.ExecuteUntil to 3.5 branch
• member replace e2e test
• Check if be is nil to avoid panic when be is overriden with nil by recoverSnapshotBackend on line 517
• Don't redeclare err and snapshot variable, fixing validation of consistent index and closing database on defer
• test: enable gofail in release e2e test.
• [3.5] backport health check e2e tests.
• tests: Extract e2e cluster setup to separate package

• Update to version 3.5.11:

  • etcdserver: add linearizable_read check to readyz.
  • etcd: Update go version to 1.20.12
  • server: disable redirects in peer communication
  • etcdserver: add metric counters for livez/readyz health checks.
  • etcdserver: add livez and ready http endpoints for etcd.
  • http health check bug fixes
  • server: Split metrics and health code
  • server: Cover V3 health with tests
  • server: Refactor health checks
  • server: Run health check tests in subtests
  • server: Rename test case expect fields
  • server: Use named struct initialization in healthcheck test
  • Backport server: Don't follow redirects when checking peer urls.
  • Backport embed: Add tracing integration test.
  • Backport server: Have tracingExporter own resources it initialises.
  • Backport server: Add sampling rate to distributed tracing.
  • upgrade github.com/stretchr/testify,google.golang.org/genproto/googleapis/api,google.golang.org/grpc to make it consistent
  • CVE-2023-47108: Backport go.opentelemetry.io/[email protected] and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected]
  • github workflow: run arm64 tests on every push
  • etcd: upgrade go version from 1.20.10 to 1.20.11
  • bump bbolt to 1.3.8 for etcd 3.5
  • 3.5: upgrade gRPC-go to 1.58.3
  • Backport corrupt check test fix 'etcd server shouldn't wait for the ready notification infinitely on startup'
  • etcdserver: add cluster id check for hashKVHandler
  • [release-3.5]: upgrade gRPC-go to v1.52.0
  • backport #14125 to release-3.5: Update to grpc-1.47 (and fix the connection-string format)
  • Return to default write scheduler since golang.org/x/[email protected] started using round robin
  • Bump go to v1.20.10 Part of https://github.com/etcd-io/etcd/issues/16740
  • bump golang.org/x/net to 0.17.0 Part of https://github.com/etcd-io/etcd/issues/16740
  • etcd: upgrade go version to 1.20.9
  • Remove obsolete http 1.0 version.
  • fix:Ensure that go version is only defined in one file for release-3.5
  • Fix panic in etcd validate secure endpoints
  • dependency: bump golang to 1.20.8
  • Backport redirect metrics data into file to reduce output.
  • test.sh: increase timeout for grpcproxy test
  • test: add v3 curl test to cover maintenance hash/hashkv REST API
  • api: fix duplicate gateway url issue
  • pkg: add a verification on the pagebytes which must be > 0
  • tests: Backport deflake for TestWatchDelay
  • tests: Backport deflake for TestPageWriterRandom
  • Backport adding unit test for socket options.
  • Backport export reuse-port and reuse-address
  • Fix goword failure in rafthttp/transport.go.
  • Backport update to golang 1.20 minor release.
  • bump go version to 1.19.12
  • Update workflows to use makefile recipes for unit, integration & e2e-release.
  • Backport Makefile recipes for common test…

This update for etcd fixes the following issues:

Update to version 3.5.12:

Security fixes:

• CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
• CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
• CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
• CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)
• CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
• CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
• CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
• CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
• CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
• CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)

Other changes:

• Added hardening to systemd service(s) (bsc#1181400)
• Fixed static /tmp file issue (bsc#1199031)
• Fixed systemd service not starting (bsc#1183703)

Full changelog:

https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

It was discovered that etcd leaked credentials when debugging was enabled. This allowed remote attackers to discover etcd authentication credentials and possibly escalate privileges on systems using etcd.