Bug 1868880 (CVE-2020-15136) - CVE-2020-15136 etcd: no authentication is performed against endpoints provided in the --endpoints flag
Summary: CVE-2020-15136 etcd: no authentication is performed against endpoints provide...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-15136
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1868881 1870189 1870508 1874768 1874872 1875653 1875654 1881174
Blocks: 1868882
TreeView+ depends on / blocked
 
Reported: 2020-08-14 06:23 UTC by Dhananjay Arunesh
Modified: 2021-07-27 22:31 UTC (History)
33 users (show)

Fixed In Version: etcd 3.4.10, etcd 3.3.23
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in etcd. The gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag.
Clone Of:
Environment:
Last Closed: 2021-03-17 19:52:14 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0916 0 None None None 2021-03-17 15:30:27 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 22:31:30 UTC

Description Dhananjay Arunesh 2020-08-14 06:23:53 UTC 
In etcd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

References:
https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md
https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
Comment 1 Dhananjay Arunesh 2020-08-14 06:24:50 UTC 
Created etcd tracking bugs for this issue:

Affects: fedora-all [bug 1868881]
Comment 2 Przemyslaw Roguski 2020-08-17 13:38:25 UTC 
External References:

https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q
Comment 8 Riccardo Schirone 2020-08-27 15:17:06 UTC 
So far only the documentation of "trusted-ca-file" was updated in https://github.com/etcd-io/etcd/commit/b86bb615ffcfc51494566e3cd8b69f8a7b408721.
Comment 13 Przemyslaw Roguski 2020-09-07 06:51:53 UTC 
Statement:

In Red Hat OpenShift Container Platform (RHOCP) the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable etcd to authenticated users only, therefore the impact by this vulnerability is Low.
A similar access restriction is in place in Red Hat OpenStack Platform (RHOSP) as etcd is limited to use within the internal API network, which is not accessible to any OpenStack tenants. Additionally, RHOSP does not use the etcd gateway.
Comment 15 errata-xmlrpc 2021-03-17 15:30:16 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2021:0916 https://access.redhat.com/errata/RHSA-2021:0916
Comment 16 Product Security DevOps Team 2021-03-17 19:52:14 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15136
Comment 17 errata-xmlrpc 2021-07-27 22:31:32 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438
Note You need to log in before you can comment on or make changes to this bug.