CVE-2020-15114
High
Description
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
SeverityHigh
CVSS7.7
Exploit probability—
Product
Redhat Etcd
PublishedAug 6, 2020
First seenAug 6, 2020
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- redhat etcd3.3.23, 3.4.10 or later
- go.etcd.io/etcd3.4.10, 3.3.23 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat etcd | 3.3.0 ≤ v < 3.3.23, 3.4.0 ≤ v < 3.4.10 | 3.3.23, 3.4.10 |
| fedoraproject fedora | 32 | — |
| go.etcd.io/etcdGo | 3.4.0-rc.0 ≤ v < 3.4.10, v < 3.3.23 | 3.4.10, 3.3.23 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.