Bug 1868870 (CVE-2020-15113)
| Summary: | CVE-2020-15113 etcd: directories created via os.MkdirAll are not checked for permissions | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abishop, bmontgom, dbecker, eparis, go-sig, gparvin, gscrivan, hvyas, jburrell, jcajka, jchaloup, jjoyce, jokerman, jramanat, jschluet, jweiser, kbasil, lacypret, lemenkov, lhh, lpeer, mburns, nstielau, puebele, rschiron, sbatsche, sclewis, skolicha, slinaber, sponnaga, stcannon, strigazi, tfister, thee |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | etcd 3.4.10, etcd 3.3.23 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in etcd. Certain directory paths are created with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-03-17 19:51:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1869240, 1868871, 1870189, 1870504, 1874764, 1874872, 1875653, 1875654, 1881173 | ||
| Bug Blocks: | 1868882 | ||
|
Description
Dhananjay Arunesh
2020-08-14 06:03:17 UTC
Created etcd tracking bugs for this issue: Affects: fedora-all [bug 1868871] Patched versions 3.4.10, 3.3.23 Care is needs to be take to ensure that no possible senario exists where etcd will fail to start because of pervious permissions. For this reason this patch will be deffered until proper testing can be completed. The failure case of "permission was not checked on existing data directory and the directory used for automatically generating self-signed certificates for TLS connections with clients" does not apply to OCP4. External References: https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92 Statement: In Red Hat OpenShift Container Platform (RHOCP) the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable etcd to authenticated users only, therefore the impact by this vulnerability is Low. A similar access restriction is in place in Red Hat OpenStack Platform (RHOSP) as etcd is limited to use within the internal API network, which is not accessible to any OpenStack tenants. This issue has been addressed in the following products: Red Hat OpenStack Platform 16.1 Via RHSA-2021:0916 https://access.redhat.com/errata/RHSA-2021:0916 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-15113 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.8 Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438 |