This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-15115 →

DEBIAN-CVE-2020-15115

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a le...

Original description

The description as published by the source.

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 etcd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-5"}]}]

Debian:13 etcd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-5"}]}]

Debian:14 etcd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-5"}]}]

References

advisory security-tracker.debian.org