In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3656-1 advisory.

    Update to version 3.5.12:

    Security fixes:

    - CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
    - CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
    - CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
    - CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled     (bsc#1121850)
    - CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
    - CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
    - CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
    - CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
    - CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
    - CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
    - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in     crypto/ssh (bsc#1217950, bsc#1218150)

    Other changes:

    - Added hardening to systemd service(s) (bsc#1181400)
    - Fixed static /tmp file issue (bsc#1199031)
    - Fixed systemd service not starting (bsc#1183703)

    Full changelog:

    https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1407 advisory.

  - In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of     a record is stored in the length field of a WAL file and no additional validation is done on this data.
    Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the     expense of any RAFT participant trying to decode the WAL. (CVE-2020-15106)

  - In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number     of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read     during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when     reading the entry. (CVE-2020-15112)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the coredns package has been released.

An update of the calico package has been released.

An update of the flannel package has been released.

An update of the etcd package has been released.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5628-2 advisory.

    USN-5628-1 fixed vulnerabilities in etcd. This update provides the corresponding updates for Ubuntu 18.04     ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5628-1 advisory.

    It was discovered that etcd incorrectly handled certain specially crafted WAL files. An attacker could     possibly use this issue to cause a denial of service. (CVE-2020-15106, CVE-2020-15112)

    It was discovered that etcd incorrectly handled directory permissions when trying to create a directory     that exists already. An attacker could possibly use this issue to obtain sensitive information.
    (CVE-2020-15113)

    It was discovered that etcd incorrectly handled endpoint setup. An attacker could possibly use this issue     to cause a denial of service. (CVE-2020-15114)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1407 advisory.

    The etcd packages provide a highly available key-value store for shared configuration.

    Security Fix(es):

    * etcd: Large slice causes panic in decodeRecord method (CVE-2020-15106)

    * etcd: DoS in wal/wal.go (CVE-2020-15112)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0916 advisory.

    A highly-available key value store for shared configuration.

    Security Fix(es):

    * large slice causes panic in decodeRecord method (CVE-2020-15106)

    * DoS in wal/wal.go (CVE-2020-15112)

    * directories created via os.MkdirAll are not checked for permissions     (CVE-2020-15113)

    * gateway can include itself as an endpoint resulting in resource     exhaustion and leads to DoS (CVE-2020-15114)

    * improper validation of passwords allow an attacker to guess or     brute-force user's passwords (CVE-2020-15115)

    * no authentication is performed against endpoints provided in the
    --endpoints flag (CVE-2020-15136)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2020-15113, CVE-2020-15112, CVE-2020-15114, CVE-2020-15115, CVE-2020-15136, CVE-2020-15106

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

= Required Actions

== Kubernetes & etcd (Security fixes)

This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_updating_kubernetes_components for the upgrade procedure.

== Skuba & helm/helm3

In order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_update_management_workstation

= Known Issues

Modifying the file `/etc/sysconfig/kubelet` directly is not supported:
documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscel laneo us.html#_configuring_kubelet

Be sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2
_4 for any additional known issues or behavioral changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
209193	openSUSE 15 Security Update : etcd (SUSE-SU-2024:3656-1)	Nessus	SuSE Local Security Checks	critical
208622	CentOS 7 : etcd (RHSA-2021:1407)	Nessus	CentOS Local Security Checks	medium
204479	Photon OS 4.0: Coredns PHSA-2023-4.0-0420	Nessus	PhotonOS Local Security Checks	high
204433	Photon OS 4.0: Calico PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204397	Photon OS 4.0: Flannel PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
203868	Photon OS 3.0: Coredns PHSA-2023-3.0-0608	Nessus	PhotonOS Local Security Checks	high
203810	Photon OS 3.0: Calico PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203783	Photon OS 3.0: Flannel PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203562	Photon OS 5.0: Calico PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
202775	Photon OS 3.0: Etcd PHSA-2020-3.0-0130	Nessus	PhotonOS Local Security Checks	high
183128	Ubuntu 18.04 ESM : etcd vulnerabilities (USN-5628-2)	Nessus	Ubuntu Local Security Checks	high
165324	Ubuntu 20.04 LTS : etcd vulnerabilities (USN-5628-1)	Nessus	Ubuntu Local Security Checks	high
149025	RHEL 7 : etcd (RHSA-2021:1407)	Nessus	Red Hat Local Security Checks	medium
147868	RHEL 8 : Red Hat OpenStack Platform 16.1.4 (etcd) (RHSA-2021:0916)	Nessus	Red Hat Local Security Checks	high
144696	Fedora 32 : etcd (2020-cd43b84c16)	Nessus	Fedora Local Security Checks	high
144173	SUSE SLES15 Security Update : Security changes in Kubernetes, etcd, / helm; Bugfix in cri-o package (SUSE-SU-2020:3760-1)	Nessus	SuSE Local Security Checks	medium
139696	Photon OS 1.0: Etcd PHSA-2020-1.0-0313	Nessus	PhotonOS Local Security Checks	high
139608	Photon OS 2.0: Etcd PHSA-2020-2.0-0272	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-15106

medium

Tenable Plugins

critical

medium

high

critical

critical

high

critical

critical

critical

high

high

high

medium

high

high

medium

high

high