CVE-2020-15112: Improper Input Validation in etcd
A flaw was found in etcd, where it is possible to have an entry index greater than the number of entries in the ReadAll method in wal/wal.go. This can cause issues when WAL entries are being read during consensus, as an arbitrary etcd consensus participant can go down from a runtime panic when reading the entry. The highest threat from this vulnerability is to system availability.
Other sources
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-15112?
CVE-2020-15112 is a vulnerability found in etcd versions 3.3.23 and 3.4.10.
What is the severity of CVE-2020-15112?
The severity of CVE-2020-15112 is medium with a CVSS score of 6.5.
How does CVE-2020-15112 affect etcd?
CVE-2020-15112 affects etcd versions 3.3.23 and 3.4.10.
How can CVE-2020-15112 be fixed?
To fix CVE-2020-15112, update etcd to version 3.4.10 or 3.3.23, depending on your current version.
Where can I find more information about CVE-2020-15112?
More information about CVE-2020-15112 can be found in the following references: - [GitHub Security Advisory](https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93) - [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1868873) - [etcd GitHub commit](https://github.com/etcd-io/etcd/commit/4571e528f49625d3de3170f219a45c3b3d38c675)