CVE-2023-32082: etcd key name can be accessed via LeaseTimeToLive API
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-32082?
CVE-2023-32082 is a vulnerability in etcd, a distributed key-value store, that allows unauthorized access to key names associated with a lease.
What is the severity of CVE-2023-32082?
The severity of CVE-2023-32082 is medium with a CVSS score of 4.3.
How can the etcd version 3.4.26 be affected by CVE-2023-32082?
Etcd version 3.4.26 is affected by CVE-2023-32082 as the vulnerability exists in versions prior to 3.4.26.
How can the etcd version 3.5.9 be affected by CVE-2023-32082?
Etcd version 3.5.9 is affected by CVE-2023-32082 as the vulnerability exists in versions prior to 3.5.9.
How can I fix CVE-2023-32082 in etcd?
To fix CVE-2023-32082 in etcd, upgrade to version 3.4.26 or 3.5.9 or later.