// For flags

CVE-2020-15112

Improper Input Validation in etcd

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

En etcd versiones anteriores a 3.3.23 y 3.4.10, es posible tener un índice de entrada mayor que el número de entradas en el método ReadAll en el archivo wal/wal.go. Esto podría causar problemas cuando las entradas de WAL se leen durante el consenso, ya que un participante arbitrario del consenso etcd, podría descender a partir de un pánico en tiempo de ejecución cuando lee la entrada

A flaw was found in etcd, where it is possible to have an entry index greater than the number of entries in the ReadAll method in wal/wal.go. This can cause issues when WAL entries are being read during consensus, as an arbitrary etcd consensus participant can go down from a runtime panic when reading the entry. The highest threat from this vulnerability is to system availability.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-06-25 CVE Reserved
  • 2020-08-05 CVE Published
  • 2023-11-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-129: Improper Validation of Array Index
  • CWE-400: Uncontrolled Resource Consumption
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Etcd
Search vendor "Etcd"
 Etcd
Search vendor "Etcd" for product "Etcd"
 < 3.3.23
Search vendor "Etcd" for product "Etcd" and version " < 3.3.23"
-
Affected
Etcd
Search vendor "Etcd"
 Etcd
Search vendor "Etcd" for product "Etcd"
 >= 3.4.0 < 3.4.10
Search vendor "Etcd" for product "Etcd" and version " >= 3.4.0 < 3.4.10"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected