Information disclosure in etcd - CVE-2023-32082

Vulnerability details

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the LeaseTimeToLive API. A remote user can gain unauthorized access to key names associated to a lease when "Keys" parameter is true.

Affected software

How to mitigate CVE-2023-32082

External References

• https://github.com/etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298
• https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md
• https://github.com/etcd-io/etcd/pull/15656
• https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md

Related Security Bulletins

• Information disclosure in etcd
• Red Hat OpenStack Platform 17 update for etcd
• openEuler 20.03 LTS SP4 update for etcd
• openEuler 22.03 LTS SP3 update for etcd
• openEuler 22.03 LTS SP4 update for etcd