Critical Access Control Vulnerability in etcd Package
Summary
DEBIAN-CVE-2023-32082: etcd is a distributed key-value store for the data of a distributed system. Affects etcd versions < 3.4.30-1. Fixed in 3.4.30-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
etcd is a distributed key-value store that is widely used for managing the data of distributed systems. It provides a reliable way to store data across a cluster of machines, ensuring consistency and availability. The package is particularly known for its role in service discovery and configuration management in cloud-native applications. However, prior to versions 3.4.26 and 3.5.9, etcd had a significant vulnerability that could expose sensitive key names to unauthorized users.
Vulnerability Detail
The vulnerability arises from the LeaseTimeToLive API, which allows access to key names associated with a lease when the 'Keys' parameter is set to true. This access is granted even if the user does not have read permissions for those keys. The issue is particularly concerning in clusters where authentication (RBAC) is enabled, as it could lead to unauthorized users gaining insight into sensitive key names, potentially compromising the security of the system.
How To Fix
Minimum fixed version
3.4.30-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade etcdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The recommended action is to update to the fixed version as soon as possible.
Conclusion
The etcd package has a critical vulnerability that allows unauthorized access to key names associated with leases. Users are urged to update to the patched version 3.4.30-1 or later to mitigate this risk. Regular monitoring for vulnerabilities, such as through tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for etcd →
FAQ
etcd is a distributed key-value store used for managing data in distributed systems, ensuring consistency and availability.
Versions prior to 3.4.26 and 3.5.9 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
It is strongly recommended to update to the patched version as soon as possible, as there are no workarounds available.
RBAC stands for Role-Based Access Control. This vulnerability is particularly concerning in environments where RBAC is enabled, as it could allow unauthorized users to access sensitive key names.
References
Related vulnerabilities
Recent vulnerabilities recorded for etcd.
