In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5628-2 advisory.

  - In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of     a record is stored in the length field of a WAL file and no additional validation is done on this data.
    Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the     expense of any RAFT participant trying to decode the WAL. (CVE-2020-15106)

  - In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number     of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read     during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when     reading the entry. (CVE-2020-15112)

  - In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and     the directory path when provided to automatically generate self-signed certificates for TLS connections     with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not     perform any permission checks when a given directory path exists already. A possible workaround is to     ensure the directories have the desired permission (700). (CVE-2020-15113)

  - In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic     service discovery and access. However, it is possible to include the gateway address as an endpoint. This     results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until     there are no more available file descriptors to accept connections on the gateway. (CVE-2020-15114)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5628-1 advisory.

  - In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of     a record is stored in the length field of a WAL file and no additional validation is done on this data.
    Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the     expense of any RAFT participant trying to decode the WAL. (CVE-2020-15106)

  - In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number     of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read     during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when     reading the entry. (CVE-2020-15112)

  - In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and     the directory path when provided to automatically generate self-signed certificates for TLS connections     with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not     perform any permission checks when a given directory path exists already. A possible workaround is to     ensure the directories have the desired permission (700). (CVE-2020-15113)

  - In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic     service discovery and access. However, it is possible to include the gateway address as an endpoint. This     results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until     there are no more available file descriptors to accept connections on the gateway. (CVE-2020-15114)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1407 advisory.

  - etcd: Large slice causes panic in decodeRecord method (CVE-2020-15106)

  - etcd: DoS in wal/wal.go (CVE-2020-15112)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0916 advisory.

  - etcd: Large slice causes panic in decodeRecord method (CVE-2020-15106)

  - etcd: DoS in wal/wal.go (CVE-2020-15112)

  - etcd: directories created via os.MkdirAll are not checked for permissions (CVE-2020-15113)

  - etcd: gateway can include itself as an endpoint resulting in resource exhaustion and leads to DoS     (CVE-2020-15114)

  - etcd: improper validation of passwords allow an attacker to guess or brute-force user's passwords     (CVE-2020-15115)

  - etcd: no authentication is performed against endpoints provided in the --endpoints flag (CVE-2020-15136)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2020-15113, CVE-2020-15112, CVE-2020-15114, CVE-2020-15115, CVE-2020-15136, CVE-2020-15106

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

= Required Actions

== Kubernetes & etcd (Security fixes)

This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_updating_kubernetes_components for the upgrade procedure.

== Skuba & helm/helm3

In order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluste r_upd ates.html#_update_management_workstation

= Known Issues

Modifying the file `/etc/sysconfig/kubelet` directly is not supported:
documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscel laneo us.html#_configuring_kubelet

Be sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2
_4 for any additional known issues or behavioral changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the etcd package has been released.

ID	Name	Product	Family	Severity
183128	Ubuntu 18.04 ESM : etcd vulnerabilities (USN-5628-2)	Nessus	Ubuntu Local Security Checks	high
165324	Ubuntu 20.04 LTS : etcd vulnerabilities (USN-5628-1)	Nessus	Ubuntu Local Security Checks	high
149025	RHEL 7 : etcd (RHSA-2021:1407)	Nessus	Red Hat Local Security Checks	medium
147868	RHEL 8 : Red Hat OpenStack Platform 16.1.4 (etcd) (RHSA-2021:0916)	Nessus	Red Hat Local Security Checks	high
144696	Fedora 32 : etcd (2020-cd43b84c16)	Nessus	Fedora Local Security Checks	high
144173	SUSE SLES15 Security Update : Security changes in Kubernetes, etcd, / helm; Bugfix in cri-o package (SUSE-SU-2020:3760-1)	Nessus	SuSE Local Security Checks	medium
139696	Photon OS 1.0: Etcd PHSA-2020-1.0-0313	Nessus	PhotonOS Local Security Checks	high
139608	Photon OS 2.0: Etcd PHSA-2020-2.0-0272	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-15106

medium

Tenable Plugins

high

high

medium

high

high

medium

high

high