etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

An update of the etcd package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and     3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys`     parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a     cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known     workarounds. (CVE-2023-32082)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the coredns package has been released.

An update of the calico package has been released.

An update of the flannel package has been released.

An update of the kubernetes package has been released.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3441 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * Information discosure via debug function (CVE-2021-28235)

    * Key name can be accessed via LeaseTimeToLive API (CVE-2023-32082)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234725	Photon OS 3.0: Etcd PHSA-2023-3.0-0586	Nessus	PhotonOS Local Security Checks	medium
226642	Linux Distros Unpatched Vulnerability : CVE-2023-32082	Nessus	Misc.	medium
204582	Photon OS 4.0: Coredns PHSA-2023-4.0-0505	Nessus	PhotonOS Local Security Checks	critical
204538	Photon OS 5.0: Etcd PHSA-2023-5.0-0012	Nessus	PhotonOS Local Security Checks	medium
204457	Photon OS 5.0: Coredns PHSA-2023-5.0-0135	Nessus	PhotonOS Local Security Checks	critical
204433	Photon OS 4.0: Calico PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204397	Photon OS 4.0: Flannel PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	critical
203813	Photon OS 3.0: Coredns PHSA-2023-3.0-0681	Nessus	PhotonOS Local Security Checks	critical
203810	Photon OS 3.0: Calico PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203783	Photon OS 3.0: Flannel PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203647	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203603	Photon OS 5.0: Flannel PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203562	Photon OS 5.0: Calico PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
203302	Photon OS 4.0: Etcd PHSA-2023-4.0-0398	Nessus	PhotonOS Local Security Checks	medium
194298	RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:3441)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2023-32082

medium

Tenable Plugins

medium

medium

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical