CVE-2018-16886

etcd, en sus versiones 3.2.x anteriores a la 3.2.26 y versiones 3.3.x anteriores a la 3.3.11, es vulnerable a una autorización incorrecta cuando se emplea un control de acceso basado en roles (RBAC) y client-cert-auth se encuentra habilitado. Si un certificado TLS del servidor etcd del cliente contiene un "Common Name" (CN) que coincide con un nombre de usuario RBAC válido, un atacante remoto podría autenticarse como dicho usuario con cualquier certificado (confiable) del cliente en una petición REST API en gRPC-gateway.

Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

This update for etcd fixes the following issues. Fixed remote command execution in cmd/go. Fixed directory traversal in cmd/go. Fixed CPU denial of service in crypto/x509. Fixed improper authentication issue when RBAC and client-cert-auth is enabled. Fixed panic in decodeRecord method. Fixed improper checks in entry index. Fixed information discosure via debug function. Fixed quadratic complexity in HPACK decoding in net/http. Fixed insufficient sanitization of Host header in go net/http. Fixed DoS vulnerability in otelgrpc. Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh Other changes. Added hardening to systemd service. Fixed static /tmp file issue. Fixed systemd service not starting.