Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2020-15106

Good to know:

icon

Date: August 5, 2020

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

Language: Go

Severity Score

Related Resources (16)

https://github.com/etcd-io/etcd/commit/4571e528f49625d3de3170f219a45c3b3d38c675
https://github.com/etcd-io/etcd/commit/f4b650b51dc4a53a8700700dc12e1242ac56ba07
https://github.com/etcd-io/etcd/commit/7d1cf640497cbcdfb932e619b13624112c7e3865
https://nvd.nist.gov/vuln/detail/CVE-2020-15106
https://security-tracker.debian.org/tracker/CVE-2020-15106
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP
https://nvd.nist.gov/vuln/detail/CVE-2020-15112
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
https://github.com/etcd-io/etcd
https://access.redhat.com/security/cve/CVE-2020-15106
https://pkg.go.dev/vuln/GO-2020-0005
https://github.com/etcd-io/etcd/pull/11793
https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf
https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93
https://www.mend.io/vulnerability-database/CVE-2020-15106

Severity Score

Weakness Type (CWE)

Improper Validation of Array Index

CWE-129

Improper Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version go.etcd.io/etcd - v0.5.0-alpha.5.0.20200423152442-f4b650b51dc4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us