Bug 2184441 (CVE-2021-28235) - CVE-2021-28235 etcd: Information discosure via debug function
Summary: CVE-2021-28235 etcd: Information discosure via debug function
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-28235
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2203153 2184945 2192839 2192840 2203157 2203158 2203159 2203161
Blocks: 2184447
TreeView+ depends on / blocked
 
Reported: 2023-04-04 17:12 UTC by Pedro Sampaio
Modified: 2024-03-15 23:45 UTC (History)
41 users (show)

Fixed In Version: go.etcd.io/etcd/v3 3.5.8
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in etcd, where etc-io could allow a remote attacker to gain elevated privileges on the system caused by a vulnerability in the debug function. By sending a specially crafted request, an attacker can gain elevated privileges.
Clone Of:
Environment:
Last Closed: 2023-06-06 00:19:34 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3441 0 None None None 2023-06-05 13:55:11 UTC
Red Hat Product Errata RHSA-2023:3445 0 None None None 2023-06-05 14:08:07 UTC
Red Hat Product Errata RHSA-2023:3447 0 None None None 2023-06-05 14:46:14 UTC

Description Pedro Sampaio 2023-04-04 17:12:19 UTC 
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

References:

https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png
https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png
http://etcd.com
https://github.com/etcd-io/etcd
Comment 2 Dhananjay Arunesh 2023-04-06 08:58:11 UTC 
Created etcd tracking bugs for this issue:

Affects: fedora-all [bug 2184945]
Comment 4 Avinash Hanwate 2023-05-11 10:42:09 UTC 
Created etcd tracking bugs for this issue:

Affects: openstack-rdo [bug 2203153]
Comment 9 errata-xmlrpc 2023-06-05 13:55:09 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.0

Via RHSA-2023:3441 https://access.redhat.com/errata/RHSA-2023:3441
Comment 10 errata-xmlrpc 2023-06-05 14:08:05 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2023:3445 https://access.redhat.com/errata/RHSA-2023:3445
Comment 11 errata-xmlrpc 2023-06-05 14:46:11 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2023:3447 https://access.redhat.com/errata/RHSA-2023:3447
Comment 12 Product Security DevOps Team 2023-06-06 00:19:30 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-28235
Note You need to log in before you can comment on or make changes to this bug.