GHSA-wr2v-9rpq-c35q

Suggest an improvement
Source
https://github.com/advisories/GHSA-wr2v-9rpq-c35q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-wr2v-9rpq-c35q/GHSA-wr2v-9rpq-c35q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wr2v-9rpq-c35q
Aliases
Related
Published
2024-01-31T00:21:56Z
Modified
2024-01-31T00:21:56Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records
Details

Vulnerability type

Cryptography

Workarounds

Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.

Detail

When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.

References

Find out more on this vulnerability in the security audit report

For more information

If you have any questions or comments about this advisory: * Contact the etcd security committee

Database specific 
{
    "nvd_published_at": "2020-08-06T23:15:00Z",
    "cwe_ids": [
        "CWE-287",
        "CWE-306"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-31T00:21:56Z"
}
References

Affected packages

Go / go.etcd.io/etcd

Package

Name
go.etcd.io/etcd
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd

Affected ranges

Type
SEMVER
Events
Introduced
3.4.0-rc.0
Fixed
3.4.10

Database specific 

{
    "last_known_affected_version_range": "<= 3.4.9"
}

Go / go.etcd.io/etcd

Package

Name
go.etcd.io/etcd
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.23