CVE-2023-32082: etcd key name can be accessed via LeaseTimeToLive API
First published: Thu May 11 2023(Updated: )
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/etcd | <3.4.26 | 3.4.26 |
| redhat/etcd | <3.5.9 | 3.5.9 |
| etcd | <3.4.26 | |
| etcd | >=3.5.0<3.5.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md
- https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md
- https://github.com/etcd-io/etcd/pull/15656
- https://github.com/etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2208132
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2208133
- https://access.redhat.com/errata/RHSA-2023:3441
- https://access.redhat.com/security/cve/cve-2023-32082
- https://bugzilla.redhat.com/show_bug.cgi?id=2208131
Frequently Asked Questions
What is CVE-2023-32082?
CVE-2023-32082 is a vulnerability in etcd, a distributed key-value store, that allows unauthorized access to key names associated with a lease.
What is the severity of CVE-2023-32082?
The severity of CVE-2023-32082 is medium with a CVSS score of 4.3.
How can the etcd version 3.4.26 be affected by CVE-2023-32082?
Etcd version 3.4.26 is affected by CVE-2023-32082 as the vulnerability exists in versions prior to 3.4.26.
How can the etcd version 3.5.9 be affected by CVE-2023-32082?
Etcd version 3.5.9 is affected by CVE-2023-32082 as the vulnerability exists in versions prior to 3.5.9.
How can I fix CVE-2023-32082 in etcd?
To fix CVE-2023-32082 in etcd, upgrade to version 3.4.26 or 3.5.9 or later.
- agent/type
- agent/remedy
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-32082
- agent/software-canonical-lookup
- agent/severity
- agent/title
- agent/event
- agent/first-publish-date
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/etcd
- canonical/etcd
- version/etcd/3.5.0