etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2019-3901:01 advisory.

    [Security Fix]
    - etcd     (RABC) etcd     gRPC-gateway REST API   TLS     RBAC  Common Name (CN)

    (CVE-2018-16886)     CVEJVNhttp://jvndb.jvn.jp/

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication     issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client     server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker     may authenticate as that user with any valid (trusted) client certificate in a REST API request to the     gRPC-gateway. (CVE-2018-16886)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3656-1 advisory.

    Update to version 3.5.12:

    Security fixes:

    - CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
    - CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
    - CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
    - CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled     (bsc#1121850)
    - CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
    - CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
    - CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
    - CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
    - CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
    - CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
    - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in     crypto/ssh (bsc#1217950, bsc#1218150)

    Other changes:

    - Added hardening to systemd service(s) (bsc#1181400)
    - Fixed static /tmp file issue (bsc#1199031)
    - Fixed systemd service not starting (bsc#1183703)

    Full changelog:

    https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the etcd package has been released.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1352 advisory.

    The etcd packages provide a highly available key-value store for shared configuration.

    The following packages have been upgraded to a later upstream version: etcd (3.2.26). (BZ#1676902)

    Security Fix(es):

    * etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway (CVE-2018-16886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

etcd.service: do not pass command line flags already defined in environment

----

Fix building of etcd

----

Bump to commit f29b1ada19713544b698dab8c94c97cfa1e83dac

----

Bump to commit e1ca3b4434945e57e8e3a451cdbde74a903cc8e1 Security fix for CVE-2018-16886 Security fix for CVE-2018-1098 CVE-2018-1099

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bump to commit e1ca3b4434945e57e8e3a451cdbde74a903cc8e1 Security fix for CVE-2018-16886 Security fix for CVE-2018-1098 CVE-2018-1099

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
289087	MiracleLinux 7 : etcd-3.2.26-1.el7 (AXSA:2019-3901:01)	Nessus	Miracle Linux Local Security Checks	high
258739	Linux Distros Unpatched Vulnerability : CVE-2018-16886	Nessus	Misc.	high
209193	openSUSE 15 Security Update : etcd (SUSE-SU-2024:3656-1)	Nessus	SuSE Local Security Checks	critical
203077	Photon OS 3.0: Etcd PHSA-2019-3.0-0036	Nessus	PhotonOS Local Security Checks	high
132540	Photon OS 2.0: Etcd PHSA-2019-2.0-0187	Nessus	PhotonOS Local Security Checks	high
125714	RHEL 7 : etcd (RHSA-2019:1352)	Nessus	Red Hat Local Security Checks	high
124600	Fedora 29 : etcd (2019-219b0b0b6a)	Nessus	Fedora Local Security Checks	high
124512	Fedora 30 : etcd (2019-833466697f)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-16886

high

Tenable Plugins

high

high

critical

high

high

high

high

high