etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

photon_os PHSA-2023-3.0-0681: Unknown PhotonOS Security Updated

photon_os PHSA-2023-3.0-0631: Unknown PhotonOS Security Updated

photon_os PHSA-2023-4.0-0427: Unknown PhotonOS Security Updated

photon_os PHSA-2023-5.0-0135: Unknown PhotonOS Security Updated

photon_os PHSA-2023-5.0-0043: Unknown PhotonOS Security Updated

photon_os PHSA-2023-5.0-0012: Unknown PhotonOS Security Updated

photon_os PHSA-2023-4.0-0505: Unknown PhotonOS Security Updated

An update of the kubernetes package has been released.

An update of the flannel package has been released.

An update of the calico package has been released.

An update of the etcd package has been released.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3441 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Information discosure via debug function (CVE-2021-28235)

    * Key name can be accessed via LeaseTimeToLive API (CVE-2023-32082)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203647	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203603	Photon OS 5.0: Flannel PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203562	Photon OS 5.0: Calico PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203302	Photon OS 4.0: Etcd PHSA-2023-4.0-0398	Nessus	PhotonOS Local Security Checks	medium
194298	RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:3441)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2023-32082

medium

Tenable Plugins

Coming Soon

critical

critical

critical

medium

critical