NVD Vulnerability Detail

CVE-2020-15136

Summary	In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
Publication Date	Aug. 7, 2020, 8:15 a.m.
Registration Date	Jan. 26, 2021, 11:53 a.m.
Last Update	Nov. 21, 2024, 2:04 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:32:::::::*

Related information, measures and tools

No	URL	タグ
1	https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md	Broken Link
2	https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md	Broken Link
3	https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q	Third Party Advisory
4	https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q	Third Party Advisory
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-306	重要な機能に対する認証の欠如解説	https://cwe.mitre.org/data/definitions/306.html

JVN Vulnerability Information

ectd における認証に関する脆弱性

Title	ectd における認証に関する脆弱性
Summary	ectd には、認証に関する脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 5, 2020, midnight
Registration Date	Oct. 19, 2020, 5:10 p.m.
Last Update	Oct. 19, 2020, 5:10 p.m.

Affected System

レッドハット

etcd 3.3.23 未満

etcd 3.4.10 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-15136	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15136
National Vulnerability Database (NVD)
2	CVE-2020-15136	https://nvd.nist.gov/vuln/detail/CVE-2020-15136

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html

ベンダー情報

No	Name	URL
GitHub
1	etcd gateway	https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md
2	Gateway TLS authentication only applies to endpoints detected in DNS SRV records	https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q

Change Log

No	Changed Details	Date of change
1	[2020年10月19日] 掲載	Oct. 19, 2020, 5:10 p.m.