SB2026072473 - Multiple vulnerabilities in etcd

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the Watch gRPC API when processing open-ended range watch requests with clientv3.WithFromKey(). A remote user can send a specially crafted watch request to disclose sensitive information.

Only clusters with authentication enabled are vulnerable. Range/Get and DeleteRange requests are not affected.

2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in tlsListener.acceptLoop when handling TCP connections that never complete the TLS handshake. A remote attacker can open many TCP connections and withhold a ClientHello to cause a denial of service.

Each connection spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and is tracked in the pending map.

Remediation

Install update from vendor's website.

References

• https://github.com/etcd-io/etcd/security/advisories/GHSA-xg4h-6gfc-h4m8
• https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
• https://github.com/etcd-io/etcd/pull/22130