etcd key name can be accessed via LeaseTimeToLive API
Résumé
etcd key name can be accessed via LeaseTimeToLive API
Description d'origine
La description telle que publiée par la source (souvent en anglais).
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-32082 etcd
- Ubuntu UBUNTU-CVE-2023-32082 etcd
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web github.com
- web github.com