Resource exhaustion in etcd - CVE-2020-15114

Vulnerability identifier: #VU41615

CSH Severity: Medium

CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]

CVE-ID: CVE-2020-15114

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote authenticated user can include the gateway address as an endpoint, trigger resource exhaustion and perform a denial of service (DoS) attack.

etcd
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Ubuntu
Fedora
etcd-server (Ubuntu package)
etcd-client (Ubuntu package)
etcd (Ubuntu package)
etcd (Red Hat package)
etcd

Install updates from vendor's website.

etcd - addressed in versions 3.3.23, 3.4.10
etcd-server (Ubuntu package) - update to 3.2.26+dfsg-6ubuntu0.1
etcd-client (Ubuntu package) - update to 3.2.26+dfsg-6ubuntu0.1
etcd (Ubuntu package) - update to 3.2.26+dfsg-6ubuntu0.1
etcd (Red Hat package) - update to 3.3.23-1.el8ost
etcd - update to 3.4.13-1.fc32

• https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224

• Multiple vulnerabilities in etcd
• Ubuntu update for etcd
• Red Hat OpenStack Platform 16 update for etcd
• Fedora 32 update for etcd