CVE-2020-15114: Denial of Service in etcd
Vulnerability type Denial of Service
Detail The etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
References Find out more on this vulnerability in the security audit report
For more information If you have any questions or comments about this advisory: Contact the etcd security committee
Other sources
A flaw was found in etcd, where the etcd gateway is a simple TCP proxy that allows basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This issue results in a denial of service since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway. The highest threat from this vulnerability is to system availability.
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-15114?
CVE-2020-15114 has been classified as a Denial of Service vulnerability.
How do I fix CVE-2020-15114?
To fix CVE-2020-15114, upgrade to etcd version 3.3.23 or 3.4.10 or later.
Which software is affected by CVE-2020-15114?
CVE-2020-15114 affects specific versions of the etcd package in Red Hat environments.
What are the potential impacts of CVE-2020-15114?
The potential impact of CVE-2020-15114 is a Denial of Service condition that can disrupt service availability.
Is CVE-2020-15114 present in older versions of etcd?
Yes, CVE-2020-15114 is present in etcd versions prior to 3.3.23 and 3.4.10.