CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15115 – No minimum password length in etcd
https://notcve.org/view.php?id=CVE-2020-15115
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort. etcd anterior a las versiones 3.3.23 y 3.4.10, no lleva a cabo ninguna comprobación de longitud de contraseña, lo que permite contraseñas muy cortas, como aquellas con una longitud de uno. Esto puede permitir a un atacante adivinar o forzar las contraseñas de los usuarios con poco esfuerzo computacional A flaw was found in etcd, where it does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This flaw allows an attacker to guess or brute-force users' passwords with little computational effort. The highest threat from this vulnerability is to confidentiality. • https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP https://access.redhat.com/security/cve/CVE-2020-15115 https://bugzilla.redhat.com/show_bug.cgi?id=1868878 • CWE-305: Authentication Bypass by Primary Weakness CWE-521: Weak Password Requirements •
CVSS: 7.5EPSS: 4%CPEs: 8EXPL: 0CVE-2020-16845 – golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
https://notcve.org/view.php?id=CVE-2020-16845
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. Go versiones anteriores a 1.13.15 y versiones 14.x anteriores a 1.14.7, puede presentar un bucle de lectura infinito en las funciones ReadUvarint y ReadVarint en encoding/binary por medio de entradas no válidas A flaw was found in the Go encoding/binary package. Certain invalid inputs to the ReadUvarint or the ReadVarint causes those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This flaw possibly leads to processing more input than expected. The highest threat from this vulnerability is to system availability. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q https://lists.debian.org/debian-lts-announce/2020/11/msg00037& • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 0CVE-2020-17368
https://notcve.org/view.php?id=CVE-2020-17368
Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection. Firejail versiones hasta 0.9.62, maneja inapropiadamente los metacaracteres de shell durante el uso de la opción --output o --output-stderr, lo que puede conllevar a una inyección de comandos • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00036.html https://github.com/netblue30/firejail https://lists.debian.org/debian-lts-announce/2020/08/msg00033.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFXN3JJG4DIMN4TAHOTKFMS7SGM4EOTR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W66IR5YT4KG464SKEMQN2NP2LGATGEGS https://security.gentoo.org/glsa/202101-02 https://www.debian.org/security/2020/dsa-4742 https • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-17367
https://notcve.org/view.php?id=CVE-2020-17367
Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection. Firejail versiones hasta 0.9.62, no respeta el indicador -- end-of-options después de la opción --output, lo que puede conllevar a una inyección de comandos • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00036.html https://github.com/netblue30/firejail https://lists.debian.org/debian-lts-announce/2020/08/msg00033.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFXN3JJG4DIMN4TAHOTKFMS7SGM4EOTR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W66IR5YT4KG464SKEMQN2NP2LGATGEGS https://security.gentoo.org/glsa/202101-02 https://www.debian.org/security/2020/dsa-4742 https • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15112 – Improper Input Validation in etcd
https://notcve.org/view.php?id=CVE-2020-15112
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry. En etcd versiones anteriores a 3.3.23 y 3.4.10, es posible tener un índice de entrada mayor que el número de entradas en el método ReadAll en el archivo wal/wal.go. Esto podría causar problemas cuando las entradas de WAL se leen durante el consenso, ya que un participante arbitrario del consenso etcd, podría descender a partir de un pánico en tiempo de ejecución cuando lee la entrada A flaw was found in etcd, where it is possible to have an entry index greater than the number of entries in the ReadAll method in wal/wal.go. This can cause issues when WAL entries are being read during consensus, as an arbitrary etcd consensus participant can go down from a runtime panic when reading the entry. • https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP https://access.redhat.com/security/cve/CVE-2020-15112 https://bugzilla.redhat.com/show_bug.cgi?id=1868872 • CWE-20: Improper Input Validation CWE-129: Improper Validation of Array Index CWE-400: Uncontrolled Resource Consumption •