{"id":"CVE-2021-28235","aliases":["AZL-26139","BIT-etcd-2021-28235","DEBIAN-CVE-2021-28235","EUVD-2023-1310","GHSA-gmph-wf7j-9gcm","OESA-2025-1168","OESA-2025-1169","OESA-2025-1170","RHSA-2023:3441","RHSA-2023:3445","RHSA-2023:3447","SUSE-SU-2024:3656-1","UBUNTU-CVE-2021-28235","USN-6189-1","openSUSE-SU-2024:12896-1","openSUSE-SU-2024:13369-1","openSUSE-SU-2024:13370-1","openSUSE-SU-2024:13371-1","openSUSE-SU-2025:0003-1"],"status":"published","title":"Etcd-io Improper Authentication vulnerability","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01618,"percentile":0.76393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287"],"published":"2023-04-04T00:00:00Z","modified":"2026-10-23T18:03:37Z","exploits":[{"source":"pocgithub","id":"h3ck13r/CVE-2021-28235","title":"h3ck13r/CVE-2021-28235","date":"2026-07-10","url":"https://github.com/h3ck13r/CVE-2021-28235"}],"fixes":[{"ecosystem":"Azure Linux:2","package":"etcd","fixed_in":["3.5.4-6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"etcd","fixed_in":["3.4.11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"etcd","fixed_in":["3.4.30-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"etcd","fixed_in":["3.4.30-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","fixed_in":["3.2.17+dfsg-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"etcd","fixed_in":["3.2.26+dfsg-6ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"etcd","fixed_in":["3.3.25+dfsg-7ubuntu0.22.04.1+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"etcd","fixed_in":["3.5.8-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.25","fixed_in":["3.5.9-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.26","fixed_in":["3.5.9-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.27","fixed_in":["3.5.9-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.10"},{"last_affected":"3.4.10"}]}],"versions":["3.4.10"]},{"source":"osv","ecosystem":"Azure Linux:2","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.10"},{"fixed":"3.4.11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.23-4","3.4.23-5","3.4.23-6","3.4.30-1","3.4.30-2","3.4.30-3","3.5.15-1","3.5.15-2","3.5.15-3","3.5.15-4","3.5.15-5","3.5.15-6","3.5.15-7","3.5.16-1","3.5.16-10","3.5.16-11","3.5.16-2","3.5.16-3","3.5.16-4","3.5.16-5","3.5.16-6","3.5.16-7","3.5.16-8","3.5.16-9","3.5.22-1","3.5.22-2","3.5.30-1~exp1","3.5.30-1~exp2","3.5.30-2","3.5.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.30-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.30-1"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd/v3","versions":["3.4.10"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-9.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-8.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-11.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.26-1.el9ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.26-1.el9ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.26-1.el9ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-14.el8ost"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-14.el8ost"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-14.el8ost"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-14.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-14.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-14.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+dfsg-2","2.2.1+dfsg-1","2.2.2+dfsg-1","2.2.2+dfsg-2","2.2.3+dfsg-1","2.2.5+dfsg-1","2.2.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.17+dfsg-1ubuntu0.1+esm2"}]}],"versions":["3.1.0-1","3.2.9+dfsg-2","3.2.9+dfsg-3","3.2.17+dfsg-1","3.2.17+dfsg-1ubuntu0.1~esm1","3.2.17+dfsg-1ubuntu0.1","3.2.17+dfsg-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.26+dfsg-6ubuntu0.2+esm1"}]}],"versions":["3.2.26+dfsg-3","3.2.26+dfsg-4","3.2.26+dfsg-6","3.2.26+dfsg-6ubuntu0.1","3.2.26+dfsg-6ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-7ubuntu0.22.04.1+esm1"}]}],"versions":["3.3.25+dfsg-6","3.3.25+dfsg-7","3.3.25+dfsg-7ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.23-4ubuntu2","3.4.30-1","3.4.30-1build1","3.4.30-1ubuntu0.24.04.1","3.4.30-1ubuntu0.24.04.2","3.4.30-1ubuntu0.24.04.2+esm1","3.4.30-1ubuntu0.24.04.3","3.4.30-1ubuntu0.24.04.3+esm1","3.4.30-1ubuntu0.24.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-10","3.5.30-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-4","3.5.16-10","3.5.16-10ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.17+dfsg-1ubuntu0.1+esm2"}]}],"versions":["3.1.0-1","3.2.9+dfsg-2","3.2.9+dfsg-3","3.2.17+dfsg-1","3.2.17+dfsg-1ubuntu0.1~esm1","3.2.17+dfsg-1ubuntu0.1","3.2.17+dfsg-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.26+dfsg-6ubuntu0.2+esm1"}]}],"versions":["3.2.26+dfsg-3","3.2.26+dfsg-4","3.2.26+dfsg-6","3.2.26+dfsg-6ubuntu0.1","3.2.26+dfsg-6ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-7ubuntu0.22.04.1+esm1"}]}],"versions":["3.3.25+dfsg-6","3.3.25+dfsg-7","3.3.25+dfsg-7ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.8-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9-1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-bp156.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-bp156.4.3.1"}]}],"bundled":5}],"products":[{"vendor":"etcd","product":"etcd"}],"references":[{"url":"https://github.com/etcd-io/etcd","tags":["x_transferred","Product","web","package"]},{"url":"https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png","tags":["x_transferred","Product","web"]},{"url":"https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png","tags":["x_transferred","Product","web"]},{"url":"https://github.com/etcd-io/etcd/pull/15648","tags":["x_transferred","web","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28235","tags":["web","advisory"]},{"url":"http://etcd.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gmph-wf7j-9gcm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28235","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1168","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32082","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1169","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1170","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3441","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208131","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3441.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28235","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28235","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32082","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3445","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184482","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196026","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196029","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3445.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41723","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41723","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vvpx-j8f3-3w6h","tags":["advisory"]},{"url":"https://go.dev/cl/468135","tags":["article"]},{"url":"https://go.dev/cl/468295","tags":["article"]},{"url":"https://go.dev/issue/57855","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1571","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2023-1571.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41724","tags":["advisory"]},{"url":"https://go.dev/cl/468125","tags":["article"]},{"url":"https://go.dev/issue/58001","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1570","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41725","tags":["advisory"]},{"url":"https://go.dev/cl/468124","tags":["article"]},{"url":"https://go.dev/issue/58006","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1569","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24534","tags":["advisory"]},{"url":"https://go.dev/issue/58975","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24536","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24536","tags":["advisory"]},{"url":"https://go.dev/issue/59153","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24537","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24537","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59180","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24538","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24538","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59234","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24539","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59720","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24540","tags":["advisory"]},{"url":"https://go.dev/issue/59721","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29400","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29400","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29400","tags":["advisory"]},{"url":"https://go.dev/issue/59722","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3447","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3447.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243656-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095184","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1121850","tags":["report"]},{"url":"https://bugzilla.suse.com/1174951","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1183703","tags":["report"]},{"url":"https://bugzilla.suse.com/1199031","tags":["report"]},{"url":"https://bugzilla.suse.com/1208270","tags":["report"]},{"url":"https://bugzilla.suse.com/1208297","tags":["report"]},{"url":"https://bugzilla.suse.com/1210138","tags":["report"]},{"url":"https://bugzilla.suse.com/1213229","tags":["report"]},{"url":"https://bugzilla.suse.com/1217070","tags":["report"]},{"url":"https://bugzilla.suse.com/1217950","tags":["report"]},{"url":"https://bugzilla.suse.com/1218150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-28235","tags":["report"]},{"url":"https://github.com/etcd-io/etcd/pull/15655","tags":["report"]},{"url":"https://github.com/etcd-io/etcd/commit/1f746597ea6ce9f0a4554108bc853f256e150b0b","tags":["report"]},{"url":"https://github.com/etcd-io/etcd/commit/3618ab4b07cc9c0883b6a642da198877e25d612b","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6189-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PE3D4WEFUCELLDKJUEM2KLPFMME7KTAI/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11254","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28235","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2023-04-04T00:00:00Z","modified":"2026-07-09T00:12:52.777Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2023-1310","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2023-04-04T00:00:00Z","modified":"2026-07-09T00:12:52Z","updated_at":"2026-11-02T18:20:09.112703Z"}],"ghsa":[{"id":"GHSA-gmph-wf7j-9gcm","title":"Etcd-io Improper Authentication vulnerability","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.\n\nThis has been fixed in v.[3.5.8](https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md#etcd-server) and was also backported to [3.4](https://github.com/etcd-io/etcd/pull/15655) and [3.5](https://github.com/etcd-io/etcd/pull/15653).","status":"published","published":"2023-04-04T15:30:27Z","modified":"2023-04-11T21:32:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:36:50.476488Z"}],"nvd":[{"id":"CVE-2021-28235","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2023-04-04T15:15:08.507Z","modified":"2026-07-09T01:16:49.477Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"AZL-26139","title":"CVE-2021-28235 affecting package etcd for versions less than 3.5.4-6","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2023-04-04T15:15:08Z","modified":"2026-04-21T04:23:28.965758Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"CVE-2021-28235","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2023-04-04T15:15:08.507Z","modified":"2026-10-20T10:54:35.904023145Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28235","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2023-04-04T15:15:08.507Z","modified":"2026-10-23T18:03:37.171879699Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-gmph-wf7j-9gcm","title":"Etcd-io Improper Authentication vulnerability","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.\n\nThis has been fixed in v.[3.5.8](https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md#etcd-server) and was also backported to [3.4](https://github.com/etcd-io/etcd/pull/15655) and [3.5](https://github.com/etcd-io/etcd/pull/15653).","status":"published","published":"2023-04-04T15:30:27Z","modified":"2023-12-06T01:01:00.695165Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"OESA-2025-1168","title":"etcd security update","description":"%{expand:\r\n\r\nSecurity Fix(es):\n\nAuthentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)\n\nParsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)\n\nEtcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor\u0026apos;s position is that this is not a vulnerability.(CVE-2022-34038)\n\nA maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)\n\netcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn\u0026apos;t have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)","status":"published","published":"2025-02-21T11:08:15Z","modified":"2026-08-18T01:18:47.503578259Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1169","title":"etcd security update","description":"%{expand:\r\n\r\nSecurity Fix(es):\n\nAuthentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)\n\nParsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)\n\nEtcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor\u0026apos;s position is that this is not a vulnerability.(CVE-2022-34038)\n\nA maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)\n\netcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn\u0026apos;t have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)","status":"published","published":"2025-02-21T11:08:16Z","modified":"2026-08-18T01:18:47.655389514Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1170","title":"etcd security update","description":"%{expand:\r\n\r\nSecurity Fix(es):\n\nAuthentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)\n\nParsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)\n\nEtcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor\u0026apos;s position is that this is not a vulnerability.(CVE-2022-34038)\n\nA maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)\n\netcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn\u0026apos;t have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)","status":"published","published":"2025-02-21T11:08:16Z","modified":"2026-08-18T01:18:47.584580496Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2023:3441","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (etcd) security update","status":"published","published":"2024-09-18T05:29:39Z","modified":"2026-08-20T10:04:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3445","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update","status":"published","published":"2024-10-02T00:15:13Z","modified":"2026-10-20T10:01:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3447","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update","status":"published","published":"2024-10-02T00:15:23Z","modified":"2026-10-20T10:01:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2021-28235","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2023-04-04T15:15:00Z","modified":"2026-10-17T12:56:14.755652775Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"BIT-etcd-2021-28235","description":"Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.","status":"published","published":"2024-03-06T10:52:10.197Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"openSUSE-SU-2024:12896-1","title":"etcd-3.5.8-1.1 on GA media","description":"These are all security issues fixed in the etcd-3.5.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:34.286542Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13369-1","title":"etcd-for-k8s1.25-3.5.9-1.1 on GA media","description":"These are all security issues fixed in the etcd-for-k8s1.25-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:36.532757Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13370-1","title":"etcd-for-k8s1.26-3.5.9-1.1 on GA media","description":"These are all security issues fixed in the etcd-for-k8s1.26-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:15.305266Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13371-1","title":"etcd-for-k8s1.27-3.5.9-1.1 on GA media","description":"These are all security issues fixed in the etcd-for-k8s1.27-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:12:40.736545Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:0003-1","title":"Security update for etcd","description":"This update for etcd fixes the following issues:\n\nUpdate to version 3.5.12:\n\n  * Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795\n  * test: fix TestHashKVWhenCompacting: ensure all goroutine finished\n  * print error log when creating peer listener failed\n  * mvcc: Printing etcd backend database related metrics inside scheduleCompaction function\n  * dependency: update go version to 1.20.13\n  * commit bbolt transaction if there is any pending deleting operations\n  * add tests to test tx delete consistency.\n  * Don't flock snapshot files\n  * Backport adding digest for etcd base image.\n  * Add a unit tests and missing flags in etcd help.\n  * Add missing flag in etcd help.\n  * Backport testutils.ExecuteUntil to 3.5 branch\n  * member replace e2e test\n  * Check if be is nil to avoid panic when be is overriden with nil by recoverSnapshotBackend on line 517\n  * Don't redeclare err and snapshot variable, fixing validation of consistent index and closing database on defer\n  * test: enable gofail in release e2e test.\n  * [3.5] backport health check e2e tests.\n  * tests: Extract e2e cluster setup to separate package\n\n- Update to version 3.5.11:\n\n  * etcdserver: add linearizable_read check to readyz.\n  * etcd: Update go version to 1.20.12\n  * server: disable redirects in peer communication\n  * etcdserver: add metric counters for livez/readyz health checks.\n  * etcdserver: add livez and ready http endpoints for etcd.\n  * http health check bug fixes\n  * server: Split metrics and health code\n  * server: Cover V3 health with tests\n  * server: Refactor health checks\n  * server: Run health check tests in subtests\n  * server: Rename test case expect fields\n  * server: Use named struct initialization in healthcheck test\n  * Backport server: Don't follow redirects when checking peer urls.\n  * Backport embed: Add tracing integration test.\n  * Backport server: Have tracingExporter own resources it initialises.\n  * Backport server: Add sampling rate to distributed tracing.\n  * upgrade github.com/stretchr/testify,google.golang.org/genproto/googleapis/api,google.golang.org/grpc to make it consistent\n  * CVE-2023-47108: Backport go.opentelemetry.io/otel@v1.20.0 and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.46.0\n  * github workflow: run arm64 tests on every push\n  * etcd: upgrade go version from 1.20.10 to 1.20.11\n  * bump bbolt to 1.3.8 for etcd 3.5\n  * 3.5: upgrade gRPC-go to 1.58.3\n  * Backport corrupt check test fix 'etcd server shouldn't wait for the ready notification infinitely on startup'\n  * etcdserver: add cluster id check for hashKVHandler\n  * [release-3.5]: upgrade gRPC-go to v1.52.0\n  * backport #14125 to release-3.5: Update to grpc-1.47 (and fix the connection-string format)\n  * Return to default write scheduler since golang.org/x/net@v0.11.0 started using round robin\n  * Bump go to v1.20.10 Part of https://github.com/etcd-io/etcd/issues/16740\n  * bump golang.org/x/net to 0.17.0 Part of https://github.com/etcd-io/etcd/issues/16740\n  * etcd: upgrade go version to 1.20.9\n  * Remove obsolete http 1.0 version.\n  * fix:Ensure that go version is only defined in one file for release-3.5\n  * Fix panic in etcd validate secure endpoints\n  * dependency: bump golang to 1.20.8\n  * Backport redirect metrics data into file to reduce output.\n  * test.sh: increase timeout for grpcproxy test\n  * test: add v3 curl test to cover maintenance hash/hashkv REST API\n  * api: fix duplicate gateway url issue\n  * pkg: add a verification on the pagebytes which must be \u003e 0\n  * tests: Backport deflake for TestWatchDelay\n  * tests: Backport deflake for TestPageWriterRandom\n  * Backport adding unit test for socket options.\n  * Backport export reuse-port and reuse-address\n  * Fix goword failure in rafthttp/transport.go.\n  * Backport update to golang 1.20 minor release.\n  * bump go version to 1.19.12\n  * Update workflows to use makefile recipes for unit, integration \u0026 e2e-release.\n  * Backport Makefile recipes for common test commands.\n  * pkg/flags: fix UniqueURLs'Set to remove duplicates in UniqueURLs'uss\n  * Backport fix to e2e release version identifcation.\n  * Backport #14368 to v3.5\n  * Follow up https://github.com/etcd-io/etcd/pull/16068#discussion_r1263667496\n  * etcdserver: backport check scheduledCompactKeyName and finishedCompactKeyName before writing hash to release-3.5.\n  * Backport #13577 Disable auth gracefully without impacting existing watchers.\n  * bump go version to 1.19.11 to fix CVE GO-2023-1878\n  * clientv3: create keepAliveCtxCloser goroutine only if ctx can be canceled\n  * [3.5] etcdutl: fix db double closed\n  * clientv3: remove v3.WithFirstKey() in Barrier.Wait()\n  * update etcdctl flag description for snapshot restores\n  * etcdutl: update description for --mark-compacted and --bump-revision flags in snapshot restore command\n  * Adding optional revision bump and mark compacted to snapshot restore\n  * Revert 'Merge pull request #16119 from natusameer/release-3.5'\n  * Add e2e-arm64.yaml and tests-arm64.yaml to release-3.5 scheduled at 1.30\n  * Backport .github/workflows: Read .go-version as a step and not separate workflow.\n  * Add first unit test for authApplierV3\n  * Early exit auth check on lease puts\n  * remove stack log when etcdutl restore\n  * etcdserver: fix corruption check when server has just been compacted\n  * replace gobin with go install\n  * [3.5] Backport updating go to latest patch release 1.19.10\n  * add compact hash check to help\n  * Fix test of clientv3/naming\n  * clientv3/naming/endpoints: fix endpoints prefix bug fixes bug with multiple endpoints with same prefix\n  * grpcproxy: fix memberlist results not update when proxy node down\n\n- Update to version 3.5.9:\n\n  * Move go version to dedicated .go-version file\n  * tests: e2e and integration test for timetolive\n  * etcdserver: protect lease timetilive with auth\n  * Backport go update to latest patch release 1.19.9.\n  * Backport centralising go version for actions workflows.\n  * server: backport 15743, improved description of --initial-cluster-state flag\n\n- Update to version 3.5.8:\n\n  * etcdserver: Guarantee order of requested progress notifications\n  * etcdserver: verify field 'username' and 'revision' present when decoding a JWT token\n  * set zap logging to wsproxy\n  * security: remove password after authenticating the user\n  * test: add an e2e test to reproduce https://nvd.nist.gov/vuln/detail/CVE-2021-28235\n  * bump golang to 1.19.8\n  * server/auth: disallow creating empty permission ranges\n  * chore: enable strict mode for test CI\n  * Fixes: #15266 All docker images of Architecture show amd64\n  * scripts: Add testing of etcd in local image in release workflow.\n  * server: Fix defer function closure escape\n  * tests: Test separate http port connection multiplexing\n  * server: Add --listen-client-http-urls flag to allow running grpc server separate from http server\n  * server: Pick one address that all grpc gateways connect to\n  * server: Extract resolveUrl helper function\n  * server: Separate client listener grouping from serving\n  * refactor: Use proper variable names for urls\n  * sever/auth: fix addUserWithNoOption of store_test\n  * server/auth: fix auth panic bug when user changes password\n  * Automated cherry-pick of #14860: Trigger release in current branch for github workflow case\n  * server/embed: fix data race when start insecure grpc\n  * server: Test watch restore\n  * mvcc: update minRev when watcher stays synced\n  * tests: Add v2 API to connection multiplexing test\n  * tests: Add connection muiltiplexer testing\n  * tests: Backport RunUtilCompletion\n  * tests: Backport tls for etcdctl\n  * tests: Extract e2e test utils\n  * tests: Allow specifying http version in curl\n  * tests: Refactor newClient args\n  * tests: Refactor CURLPrefixArgs\n  * Backport tls 1.3 support.\n  * server: Switch back to random scheduler to improve resilience to watch starvation\n  * test: Test etcd watch stream starvation under high read response load when sharing the same connection\n  * tests: Allow configuring progress notify interval in e2e tests\n  * Run go mod tidy\n  * Updated go to 1.19.7.\n  * Backport go_srcs_in_module changes and fix goword failures.\n  * Formatted source code for go 1.19.6.\n  *  Bump to go 1.19.6\n  *  Bump golang.org/x/net to v0.7.0 to address CVE GO-2023-1571.\n  * test:enhance the test case TestV3WatchProgressOnMemberRestart\n  * clientv3: correct the nextRev on receving progress notification response\n  * etcdserver: add failpoints walBeforeSync and walAfterSync\n  * Fix regression in timestamp resolution\n  * upgrade cockroachdb/datadriven to v1.0.2 to remove archived dependencies\n  * bump github.com/stretchr/testify to v1.8.1\n  * bump bbolt to v1.3.7 for release-3.5\n  * netutil: consistently format ipv6 addresses\n  * docker: remove nsswitch.conf\n\n- Update to version 3.5.7:\n\n  * etcdserver: return membership.ErrIDNotFound when the memberID not found\n  * etcdserver: process the scenaro of the last WAL record being partially synced to disk\n  * update nsswitch.conf for 3.5\n  * 3.5: remove the dependency on busybox\n  * Remove dependency on gobin\n  * resolve build error: parameter may not start with quote character '\n  * remove .travis.yml\n  * format the source code and tidy the dependencies using go 1.17.13\n  * bump go version to 1.17.13\n  * deps: bump golang.org/x/net to v0.4.0 to address CVEs\n  * security: use distroless base image to address critical Vulnerabilities\n  * cidc:  specify the correct branch name of release-3.5 in workflow for trivy nightly scan\n  * Add trivy nightly scan for release-3.5\n  * clientv3: revert the client side change in 14547\n  * client/pkg/v3: fixes Solaris build of transport\n  * etcdserver: fix nil pointer panic for readonly txn\n  * Fix go fmt error\n  * [3.5] Backport: non mutating requests pass through quotaKVServer when NOSPACE\n  * etcdserver: intentionally set the memberID as 0 in corruption alarm\n \n- Update to version 3.5.6:\n\n  * release: build with consistent paths\n  * client/pkg/fileutil: add missing logger to {Create,Touch}DirAll\n  * test: add test case to cover the CommonName based authentication\n  * test: add certificate with root CommonName\n  * clientv3: do not refresh token when using TLS CommonName based authentication\n  * etcdserver: call the OnPreCommitUnsafe in unsafeCommit\n  * add range flag for delete in etcdctl\n  * server: add more context to panic message\n  * fix:close conn\n  * clientv3: fix the design \u0026 implementation of double barrier\n  * test: added e2e test case for issue 14571: etcd doesn't load auth info when recovering from a snapshot\n  * etcdserver: call refreshRangePermCache on Recover() in AuthStore. #14574\n  * server: add a unit test case for authStore.Reocver() with empty rangePermCache\n  * Backport #14591 to 3.5.\n  * client/v3: Add backoff before retry when watch stream returns unavailable\n  * etcdserver: added more debug log for the purgeFile goroutine\n  * netutil: make a `raw` URL comparison part of the urlsEqual function\n  * Apply suggestions from code review\n  * netutil: add url comparison without resolver to URLStringsEqual\n  * tests/Dockerfile: Switch to ubuntu 22.04 base\n  * Makefile: Additional logic fix\n  * *: avoid closing a watch with ID 0 incorrectly\n  * tests: a test case for watch with auth token expiration\n  * *: handle auth invalid token and old revision errors in watch\n  * server/etcdmain: add configurable cipher list to gRPC proxy listener\n  * Replace github.com/form3tech-oss/jwt-go with https://github.com/golang-jwt/jwt/v4\n\n- Update to version 3.5.5:\n\n  * fix the flaky test fix_TestV3AuthRestartMember_20220913 for 3.5\n  * etcdctl: fix move-leader for multiple endpoints\n  * testing: fix TestOpenWithMaxIndex cleanup\n  * server,test: refresh cache on each NewAuthStore\n  * server/etcdmain: add build support for Apple M1\n  * tests: Fix member id in CORRUPT alarm\n  * server: Make corrtuption check optional and period configurable\n  * server: Implement compaction hash checking\n  * tests: Cover periodic check in tests\n  * server: Refactor compaction checker\n  * tests: Move CorruptBBolt to testutil\n  * tests: Rename corruptHash to CorruptBBolt\n  * tests: Unify TestCompactionHash and extend it to also Delete keys and Defrag\n  * tests: Add tests for HashByRev HTTP API\n  * tests: Add integration tests for compact hash\n  * server: Cache compaction hash for HashByRev API\n  * server: Extract hasher to separate interface\n  * server: Remove duplicated compaction revision\n  * server: Return revision range that hash was calcualted for\n  * server: Store real rv range in hasher\n  * server: Move adjusting revision to hasher\n  * server: Pass revision as int\n  * server: Calculate hash during compaction\n  * server: Fix range in mock not returning same number of keys and values\n  * server: Move reading KV index inside scheduleCompaction function\n  * server: Return error from scheduleCompaction\n  * server: Refactor hasher\n  * server: Extract kvHash struct\n  * server: Move unsafeHashByRev to new hash.go file\n  * server: Extract unsafeHashByRev function\n  * server: Test HashByRev values to make sure they don't change\n  * server: Cover corruptionMonitor with tests\n  * server: Extract corruption detection to dedicated struct\n  * server: Extract triggerCorruptAlarm to function\n  * move consistent_index forward when executing alarmList operation\n  * fix the potential data loss for clusters with only one member\n  * [backport 3.5] server: don't panic in readonly serializable txn\n  * Backport of pull/14354 to 3.5.5\n  * Refactor the keepAliveListener and keepAliveConn\n  * clientv3: close streams after use in lessor keepAliveOnce method\n  * Change default sampling rate from 100% to 0%\n  * Fix the failure in TestEndpointSwitchResolvesViolation\n  * update all related dependencies\n  * move setupTracing into a separate file config_tracing.go\n  * etcdserver: bump OpenTelemetry to 1.0.1\n  * Change default sampling rate from 100% to 0%\n  * server/auth: protect rangePermCache with a RW lock\n  * Improve error message for incorrect values of ETCD_CLIENT_DEBUG\n  * add e2e test cases to cover the maxConcurrentStreams\n  * Add flag `--max-concurrent-streams` to set the max concurrent stream each client can open at a time\n  * add the uint32Value data type\n  * Client: fix check for WithPrefix op\n  * client/v3: do not overwrite authTokenBundle on dial\n  * restrict the max size of each WAL entry to the remaining size of the file\n  * Add FileReader and FileBufReader utilities\n  * Backport two lease related bug fixes to 3.5\n  * scripts: Detect staged files before building release\n  * scripts: Avoid additional repo clone\n  * Make DRY_RUN explicit\n  * scripts: Add tests for release scripts\n  * server/auth: enable tokenProvider if recoved store enables auth\n  * Update golang.org/x/crypto to latest\n\n- Update to version 3.5.4:\n\n  * Update conssitent_index when applying fails\n  * Add unit test for canonical SRV records\n  * Revert 'trim the suffix dot from the srv.Target for etcd-client DNS lookup'\n\n- add variable ETCD_OPTIONS to both service unit and configuration file\n  this allows the user to easily add things like '--enable-v2=true'\n\n- Update to version 3.5.3:\n\n  https://github.com/etcd-io/etcd/compare/v3.5.2...v3.5.3\n  * clientv3: disable mirror auth test with proxy\n  * cv3/mirror: Fetch the most recent prefix revision\n  * set backend to cindex before recovering the lessor in applySnapshot\n  * support linearizable renew lease\n  * clientv3: filter learners members during autosync\n  * etcdserver: upgrade the golang.org/x/crypto dependency\n  * fix the data inconsistency issue by adding a txPostLockHook into the backend\n  * server: Save consistency index and term to backend even when they decrease\n  * server: Add verification of whether lock was called within out outside of apply\n  * go.mod: Upgrade to prometheus/client_golang v1.11.1\n  * server: Use default logging configuration instead of zap production one\n  * Fix offline defrag\n  * backport 3.5: #13676 load all leases from backend\n  * server/storage/backend: restore original bolt db options after defrag\n  * always print raft term in decimal when displaying member list in json\n  * enhance health check endpoint to support serializable request\n  * trim the suffix dot from the srv.Target for etcd-client DNS lookup\n\n- Drop ETCD_UNSUPPORTED_ARCH=arm64 from sysconfig as ARM64 is now officially supported\n- Update etcd.conf variables\n- Add the new etcdutl into separate subpackage\n\n- Update to version 3.5.2:\n\n  * Update dep: require gopkg.in/yaml.v2 v2.2.8 -\u003e v2.4.0 due to: CVE-2019-11254.\n  * fix runlock bug\n  * server: Require either cluster version v3.6 or --experimental-enable-lease-checkpoint-persist to persist lease remainingTTL\n  * etcdserver,integration: Store remaining TTL on checkpoint\n  * lease,integration: add checkpoint scheduling after leader change\n  * set the backend again after recovering v3 backend from snapshot\n  * *: implement a retry logic for auth old revision in the client\n  * client/v3: refresh the token when ErrUserEmpty is received while retrying\n  * server/etcdserver/api/etcdhttp: exclude the same alarm type activated by multiple peers\n  * storage/backend: Add a gauge to indicate if defrag is active (backport from 3.6)\n\n- Update to version 3.5.1:\n\n  * version: 3.5.1\n  * Dockerfile: bump debian bullseye-20210927\n  * client: Use first endpoint as http2 authority header\n  * tests: Add grpc authority e2e tests\n  * client: Add grpc authority header integration tests\n  * tests: Allow configuring integration tests to use TCP\n  * test: Use unique number for grpc port\n  * tests: Cleanup member interface by exposing Bridge directly\n  * tests: Make using bridge optional\n  * tests: Rename grpcAddr to grpcURL to imply that it includes schema\n  * tests: Remove bridge dependency on unix\n  * Decouple prefixArgs from os.Env dependency\n  * server: Ensure that adding and removing members handle storev2 and backend out of sync\n  * Stop using tip golang version in CI\n  * fix self-signed-cert-validity parameter cannot be specified in the config file\n  * fix health endpoint not usable when authentication is enabled\n  * workflows: remove ARM64 job for maintenance\n\n- Update to version 3.5.0:\n\n  * See link below, diff is too big\n    https://github.com/etcd-io/etcd/compare/v3.4.16...v3.5.0\n\n- Added hardening to systemd service(s) (boo#1181400)\n\n- Change to sysuser-tools to create system user\n\n- Update to version 3.4.16:\n\n  * Backport-3.4 exclude alarms from health check conditionally\n  * etcdserver/mvcc: update trace.Step condition\n  * Backport-3.4 etcdserver/util.go: reduce memory when logging range requests\n  * .travis,Makefile,functional: Bump go 1.12 version to v1.12.17\n  * integration: Fix 'go test --tags cluster_proxy --timeout=30m -v ./integration/...'\n  * pkg/tlsutil: Adjust cipher suites for go 1.12\n  * Fix pkg/tlsutil (test) to not fail on 386.\n  * bill-of-materials.json: Update golang.org/x/sys\n  * .travis,test: Turn race off in Travis for go version 1.15\n  * integration : fix TestTLSClientCipherSuitesMismatch in go1.13\n  * vendor: Run go mod vendor\n  * go.mod,go.sum: Bump github.com/creack/pty that includes patch\n  * go.mod,go.sum: Comply with go v1.15\n  * etcdserver,wal: Convert int to string using rune()\n  * integration,raft,tests: Comply with go v1.15 gofmt\n  * .travis.yml: Test with go v1.15.11\n  * pkpkg/testutil/leak.go: Allowlist created by testing.runTests.func1\n  * vendor: Run go mod vendor\n  * go.sum, go.mod: Run go mod tidy with go 1.12\n  * go.mod: Pin go to 1.12 version\n  * etcdserver: fix incorrect metrics generated when clients cancel watches\n  * integration: relax leader timeout from 3s to 4s\n  * etcdserver: when using --unsafe-no-fsync write data\n  * server: Added config parameter experimental-warning-apply-duration\n  * etcdserver: Fix PeerURL validation\n\n- update etcd.service: avoid args from commandline and environment\n  as it leads to start failure (boo#1183703) \n\n- Update to version 3.4.15:\n\n  * [Backport-3.4] etcdserver/api/etcdhttp: log successful etcd server side health check in debug level\n  * etcdserver: Fix 64 KB websocket notification message limit\n  * vendor: bump gorilla/websocket\n  * pkg/fileutil: fix F_OFD_ constants\n\n- Update to version 3.4.14:\n\n  * pkg/netutil: remove unused 'iptables' wrapper\n  * tools/etcd-dump-metrics: validate exec cmd args\n  * clientv3: get AuthToken automatically when clientConn is ready.\n  * etcdserver: add ConfChangeAddLearnerNode to the list of config changes\n  * integration: add flag WatchProgressNotifyInterval in integration test\n\n- Update to version 3.4.13:\n\n  * pkg: file stat warning\n  * Automated cherry pick of #12243 on release 3.4\n  * version: 3.4.12\n  * etcdserver: Avoid panics logging slow v2 requests in integration tests\n  * version: 3.4.11\n  * Revert 'etcdserver/api/v3rpc: 'MemberList' never return non-empty ClientURLs'\n  * *: fix backport of PR12216\n  * *: add experimental flag for watch notify interval\n  * clientv3: remove excessive watch cancel logging\n  * etcdserver: add OS level FD metrics\n  * pkg/runtime: optimize FDUsage by removing sort\n  * clientv3: log warning in case of error sending request\n  * etcdserver/api/v3rpc: 'MemberList' never return non-empty ClientURLs\n\n- Update to version 3.4.10 [CVE-2020-15106][boo#1174951]:\n\n  * Documentation: note on data encryption\n  * etcdserver: change protobuf field type from int to int64 (#12000)\n  * pkg: consider umask when use MkdirAll\n  * etcdmain: let grpc proxy warn about insecure-skip-tls-verify\n  * etcdmain: fix shadow error\n  * pkg/fileutil: print desired file permission in error log\n  * pkg: Fix dir permission check on Windows\n  * auth: Customize simpleTokenTTL settings.\n  * mvcc: chanLen 1024 is to biger,and it used more memory. 128 seems to be enough. Sometimes the consumption speed is more than the production speed.\n  * auth: return incorrect result 'ErrUserNotFound' when client request without username or username was empty.\n  * etcdmain: fix shadow error\n  * doc: add TLS related warnings\n  * etcdserver:FDUsage set ticker to 10 minute from 5 seconds. This ticker will check File Descriptor Requirements ,and count all fds in used. And recorded some logs when in used \u003e= limit/5*4. Just recorded message. If fds was more than 10K,It's low performance due to FDUsage() works. So need to increase it.\n  * clientv3: cancel watches proactively on client context cancellation\n  * wal: check out of range slice in 'ReadAll', 'decoder'\n  * etcdctl, etcdmain: warn about --insecure-skip-tls-verify options\n  * Documentation: note on the policy of insecure by default\n  * etcdserver: don't let InternalAuthenticateRequest have password\n  * auth: a new error code for the case of password auth against no password user\n  * Documentation: note on password strength\n  * etcdmain: best effort detection of self pointing in tcp proxy\n  * Discovery: do not allow passing negative cluster size\n  * wal: fix panic when decoder not set\n  * embed: fix compaction runtime err\n  * pkg: check file stats\n  * etcdserver, et al: add --unsafe-no-fsync flag\n  * wal: add TestValidSnapshotEntriesAfterPurgeWal testcase\n  * wal: fix crc mismatch crash bug\n  * rafthttp: log snapshot download duration\n  * rafthttp: improve snapshot send logging\n  *  *: make sure snapshot save downloads SHA256 checksum\n  * etcdserver/api/snap: exclude orphaned defragmentation files in snapNames\n  * etcdserver: continue releasing snap db in case of error\n  * etcdserver,wal: fix inconsistencies in WAL and snapshot\n  * cherry pick of #11564 (#11880)\n  * mvcc: fix deadlock bug\n  * auth: optimize lock scope for CheckPassword\n  * auth: ensure RoleGrantPermission is compatible with older versions\n  * etcdserver: print warn log when failed to apply request\n  * auth: cleanup saveConsistentIndex in NewAuthStore\n  * auth: print warning log when error is ErrAuthOldRevision\n  * auth: add new metric 'etcd_debugging_auth_revision'\n  * tools/etcd-dump-db: add auth decoder, optimize print format\n  * *: fix auth revision corruption bug\n  * etcdserver: watch stream got closed once one request is not permitted (#11708)\n  * version: 3.4.7\n  * wal: add 'etcd_wal_writes_bytes_total'\n  * pkg/ioutil: add 'FlushN'\n  * test: auto detect branch when finding merge base\n  * mvcc/kvstore:when the number key-value is greater than one million, compact take too long and blocks other requests\n  * version: 3.4.6\n  * lease: fix memory leak in LeaseGrant when node is follower\n  * version: 3.4.5\n  * words: whitelist 'racey'\n  * Revert 'version: 3.4.5'\n  * words: whitelist 'hasleader'\n  * version: 3.4.5\n  * etcdserver/api/v3rpc: handle api version metadata, add metrics\n  * clientv3: embed api version in metadata\n  * etcdserver/api/etcdhttp: log server-side /health checks\n  * proxy/grpcproxy: add return on error for metrics handler\n  * etcdctl: fix member add command\n  * etcdserver: fix quorum calculation when promoting a learner member\n  * etcdserver: corruption check via http\n  * mvcc/backend: check for nil boltOpenOptions\n  * mvcc/backend: Delete orphaned db.tmp files before defrag\n  * auth: correct logging level\n  * e2e: test curl auth on onoption user\n  * auth: fix NoPassWord check when add user\n  * auth: fix user.Options nil pointer\n  * mvcc/kvstore:fixcompactbug\n  * mvcc: update to 'etcd_debugging_mvcc_total_put_size_in_bytes'\n  * mvcc: add 'etcd_mvcc_put_size_in_bytes' to monitor the throughput of put request.\n  * clientv3: fix retry/streamer error message\n  * etcdserver: wait purge file loop during shutdown\n  * integration: disable TestV3AuthOldRevConcurrent\n  * etcdserver: remove auth validation loop\n  * scripts/release: list GPG key only when tagging is needed\n\n","status":"published","published":"2025-01-07T15:04:12Z","modified":"2026-02-04T04:30:26.668293Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:3656-1","title":"Security update for etcd","description":"This update for etcd fixes the following issues:\n\nUpdate to version 3.5.12:\n\nSecurity fixes:\n\n- CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)\n- CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)\n- CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)\n- CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)\n- CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)\n- CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)\n- CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)\n- CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)\n- CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)\n- CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)\n\nOther changes:\n\n- Added hardening to systemd service(s) (bsc#1181400)\n- Fixed static /tmp file issue (bsc#1199031)\n- Fixed systemd service not starting (bsc#1183703)\n\nFull changelog:\n\nhttps://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12\n","status":"published","published":"2024-10-16T11:33:42Z","modified":"2026-02-04T02:49:49.268837Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-6189-1","title":"etcd vulnerability","description":"It was discovered that etcd leaked credentials when debugging\nwas enabled. This allowed remote attackers to discover etcd \nauthentication credentials and possibly escalate privileges on\nsystems using etcd.\n","status":"published","published":"2023-06-28T20:01:23Z","modified":"2026-04-27T16:44:36.78615Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}