CVE-2020-15106: falha de média gravidade em etcd-io etcd
Improper Input Validation in etcd
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 1.3%
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
etcd-io · etcdCVEs relacionadas — etcd-io etcd
No mesmo produto, das mais perigosas para as menos.
CVE-2020-15136MEDIUMImproper authentication in etcdEPSS 1.7%CVE-2020-15115MEDIUMNo minimum password length in etcdEPSS 1.3%CVE-2020-15112MEDIUMImproper Input Validation in etcdEPSS 1.3%CVE-2020-15114HIGHDenial of Service in etcdEPSS 1.1%CVE-2023-32082LOWetcd key name can be accessed via LeaseTimeToLive APIEPSS 0.7%CVE-2026-73499HIGHetcd: Watch API authorization bypass via open-ended range requestsEPSS 0.7%