CVE-2018-1099: Input Validation
First published: Sun Feb 25 2018(Updated: )
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/etcd | <3.4.0 | 3.4.0 |
| Redhat Etcd | <=3.3.1 | |
| Fedoraproject Fedora | =30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/coreos/etcd/issues/9353
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1552720
- https://github.com/coreos/etcd/commit/a7e5790c82039945639798ae9a3289fe787f5e56
- https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/
- https://bugzilla.redhat.com/show_bug.cgi?id=1552717
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/remedy
- agent/severity
- agent/first-publish-date
- agent/type
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-1099
- agent/software-canonical-lookup
- agent/tags
- agent/event
- vendor/redhat
- canonical/redhat etcd
- version/redhat etcd/3.3.1
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/30
- package-manager/redhat