etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

An update of the coredns package has been released.

An update of the etcd package has been released.

An update of the calico package has been released.

An update of the flannel package has been released.

An update of the kubernetes package has been released.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3441 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Information discosure via debug function (CVE-2021-28235)

    * Key name can be accessed via LeaseTimeToLive API (CVE-2023-32082)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204582	Photon OS 4.0: Coredns PHSA-2023-4.0-0505	Nessus	PhotonOS Local Security Checks	critical
204538	Photon OS 5.0: Etcd PHSA-2023-5.0-0012	Nessus	PhotonOS Local Security Checks	medium
204457	Photon OS 5.0: Coredns PHSA-2023-5.0-0135	Nessus	PhotonOS Local Security Checks	critical
204433	Photon OS 4.0: Calico PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204397	Photon OS 4.0: Flannel PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	critical
203813	Photon OS 3.0: Coredns PHSA-2023-3.0-0681	Nessus	PhotonOS Local Security Checks	critical
203810	Photon OS 3.0: Calico PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203783	Photon OS 3.0: Flannel PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203647	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203603	Photon OS 5.0: Flannel PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203562	Photon OS 5.0: Calico PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203302	Photon OS 4.0: Etcd PHSA-2023-4.0-0398	Nessus	PhotonOS Local Security Checks	medium
196026	RHEL 7 : etcd (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
194298	RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:3441)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2023-32082

medium

Tenable Plugins

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical