Описание
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| cosmic | ignored | end of life |
| devel | not-affected | 3.2.26+dfsg-3 |
| disco | ignored | end of life |
| eoan | not-affected | 3.2.26+dfsg-3 |
| esm-apps/bionic | needed | |
| esm-apps/focal | not-affected | 3.2.26+dfsg-3 |
| esm-apps/jammy | not-affected | 3.2.26+dfsg-3 |
| esm-apps/noble | not-affected | 3.2.26+dfsg-3 |
| esm-apps/xenial | not-affected | code not present |
Показывать по
Ссылки на источники
6.8 Medium
CVSS2
8.1 High
CVSS3
Связанные уязвимости
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerab ...
Уязвимость реализации функции контроля доступа на основе ролей Role Based Access Control (RBAC) хранилища параметров конфигурации Etcd, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
6.8 Medium
CVSS2
8.1 High
CVSS3