redhat etcd CVE-2020-15136 in Red Hat and Fedora Project Products
Published on August 6, 2020

Improper authentication in etcd

product logo product logo
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-15136 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is an authentification Vulnerability?

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

CVE-2020-15136 has been classified to as an authentification vulnerability or weakness.


Products Associated with CVE-2020-15136

stack.watch emails you whenever new vulnerabilities are published in Red Hat Etcd or Fedora Project Fedora. Just hit a watch button to start following.

Red Hat Etcd
 
Fedora Project Fedora
 

Affected Versions

etcd-io etcd:

Exploit Probability

EPSS
0.31%
Percentile
53.60%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.