The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3656-1 advisory.

    Update to version 3.5.12:

    Security fixes:

    - CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
    - CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
    - CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
    - CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled     (bsc#1121850)
    - CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
    - CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
    - CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
    - CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
    - CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
    - CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
    - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in     crypto/ssh (bsc#1217950, bsc#1218150)

    Other changes:

    - Added hardening to systemd service(s) (bsc#1181400)
    - Fixed static /tmp file issue (bsc#1199031)
    - Fixed systemd service not starting (bsc#1183703)

    Full changelog:

    https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

openSUSE 15 Security Update : etcd (SUSE-SU-2024:3656-1)

high Nessus Plugin ID 209193

Version 1.2

Version 1.1

Version 1.2 Oct 18, 2024, 12:11 PM IAVM reference Plugin Feed: 202410181211
Version 1.1 Oct 17, 2024, 9:46 AM New Plugin Feed: 202410170946