In etcd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality. References: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
Created etcd tracking bugs for this issue: Affects: fedora-all [bug 1868881]
External References: https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
So far only the documentation of "trusted-ca-file" was updated in https://github.com/etcd-io/etcd/commit/b86bb615ffcfc51494566e3cd8b69f8a7b408721.
Statement: In Red Hat OpenShift Container Platform (RHOCP) the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable etcd to authenticated users only, therefore the impact by this vulnerability is Low. A similar access restriction is in place in Red Hat OpenStack Platform (RHOSP) as etcd is limited to use within the internal API network, which is not accessible to any OpenStack tenants. Additionally, RHOSP does not use the etcd gateway.
This issue has been addressed in the following products: Red Hat OpenStack Platform 16.1 Via RHSA-2021:0916 https://access.redhat.com/errata/RHSA-2021:0916
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-15136
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.8 Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438