Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3656-1 advisory.

    Update to version 3.5.12:

    Security fixes:

    - CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
    - CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
    - CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
    - CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled     (bsc#1121850)
    - CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
    - CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
    - CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
    - CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
    - CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
    - CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
    - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in     crypto/ssh (bsc#1217950, bsc#1218150)

    Other changes:

    - Added hardening to systemd service(s) (bsc#1181400)
    - Fixed static /tmp file issue (bsc#1199031)
    - Fixed systemd service not starting (bsc#1183703)

    Full changelog:

    https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the coredns package has been released.

An update of the kubernetes package has been released.

An update of the calico package has been released.

An update of the flannel package has been released.

An update of the etcd package has been released.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - etcd: Cross-site request forgery via crafted local POST forms (CVE-2018-1098)

  - etcd: Information discosure via debug function (CVE-2021-28235)

  - DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to     direct to localhost, and trick the browser into sending requests to localhost (or any other address).
    (CVE-2018-1099)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3441 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Information discosure via debug function (CVE-2021-28235)

    * Key name can be accessed via LeaseTimeToLive API (CVE-2023-32082)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3447 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Information discosure via debug function (CVE-2021-28235)

    * golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding     (CVE-2022-41723)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3445 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Information discosure via debug function (CVE-2021-28235)

    * html/template: improper handling of JavaScript whitespace     (CVE-2023-24540)

    * golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding     (CVE-2022-41723)

    * crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * net/http mime/multipart: denial of service from excessive resource     consumption (CVE-2022-41725)

    * net/http net/textproto: denial of service from excessive memory     allocation (CVE-2023-24534)

    * net/http net/textproto mime/multipart: denial of service from excessive     resource consumption (CVE-2023-24536)

    * go/parser: Infinite loop in parsing (CVE-2023-24537)

    * html/template: backticks not treated as string delimiters     (CVE-2023-24538)

    * html/template: improper sanitization of CSS values (CVE-2023-24539)

    * html/template: improper handling of empty HTML attributes     (CVE-2023-29400)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6189-1 advisory.

    It was discovered that etcd leaked credentials when debugging was enabled. This allowed remote attackers     to discover etcd

    authentication credentials and possibly escalate privileges on systems using etcd.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of etcd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-28235 advisory.

  - Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via     the debug function. (CVE-2021-28235)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209193	openSUSE 15 Security Update : etcd (SUSE-SU-2024:3656-1)	Nessus	SuSE Local Security Checks	critical
204582	Photon OS 4.0: Coredns PHSA-2023-4.0-0505	Nessus	PhotonOS Local Security Checks	critical
204457	Photon OS 5.0: Coredns PHSA-2023-5.0-0135	Nessus	PhotonOS Local Security Checks	critical
204440	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204433	Photon OS 4.0: Calico PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204397	Photon OS 4.0: Flannel PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	critical
203943	Photon OS 3.0: Etcd PHSA-2023-3.0-0578	Nessus	PhotonOS Local Security Checks	critical
203813	Photon OS 3.0: Coredns PHSA-2023-3.0-0681	Nessus	PhotonOS Local Security Checks	critical
203810	Photon OS 3.0: Calico PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203783	Photon OS 3.0: Flannel PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203746	Photon OS 3.0: Kubernetes PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203647	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203603	Photon OS 5.0: Flannel PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203562	Photon OS 5.0: Calico PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203347	Photon OS 4.0: Etcd PHSA-2023-4.0-0391	Nessus	PhotonOS Local Security Checks	critical
199006	RHEL 7 : etcd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196026	RHEL 7 : etcd (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
194298	RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:3441)	Nessus	Red Hat Local Security Checks	critical
194244	RHEL 8 : Red Hat OpenStack Platform 16.1 (etcd) (RHSA-2023:3447)	Nessus	Red Hat Local Security Checks	critical
193752	RHEL 8 : Red Hat OpenStack Platform 16.2 (etcd) (RHSA-2023:3445)	Nessus	Red Hat Local Security Checks	critical
177696	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM / 23.04 : etcd vulnerability (USN-6189-1)	Nessus	Ubuntu Local Security Checks	critical
174759	CBL Mariner 2.0 Security Update: etcd (CVE-2021-28235)	Nessus	MarinerOS Local Security Checks	critical

Detections

Analytics

CVE-2021-28235

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical