The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3447 advisory.

  - etcd: Information discosure via debug function (CVE-2021-28235)

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of etcd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-28235 advisory.

  - Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via     the debug function. (CVE-2021-28235)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.10 / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6189-1 advisory.

  - Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via     the debug function. (CVE-2021-28235)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - etcd: Cross-site request forgery via crafted local POST forms (CVE-2018-1098)

  - etcd: Information discosure via debug function (CVE-2021-28235)

  - DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to     direct to localhost, and trick the browser into sending requests to localhost (or any other address).
    (CVE-2018-1099)

  - In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and     the directory path when provided to automatically generate self-signed certificates for TLS connections     with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not     perform any permission checks when a given directory path exists already. A possible workaround is to     ensure the directories have the desired permission (700). (CVE-2020-15113)

  - In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic     service discovery and access. However, it is possible to include the gateway address as an endpoint. This     results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until     there are no more available file descriptors to accept connections on the gateway. (CVE-2020-15114)

  - etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for     very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-     force users' passwords with little computational effort. (CVE-2020-15115)

  - In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints     detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on     endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints     function. No authentication is performed against endpoints provided in the --endpoints flag. This has been     fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
    (CVE-2020-15136)

  - Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in     pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability. (CVE-2022-34038)

  - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and     3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys`     parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a     cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known     workarounds. (CVE-2023-32082)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3441 advisory.

  - etcd: Information discosure via debug function (CVE-2021-28235)

  - etcd: Key name can be accessed via LeaseTimeToLive API (CVE-2023-32082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3445 advisory.

  - etcd: Information discosure via debug function (CVE-2021-28235)

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
194244	RHEL 8 : Red Hat OpenStack Platform 16.1 (etcd) (RHSA-2023:3447)	Nessus	Red Hat Local Security Checks	4/28/2024	4/28/2024	critical
174759	CBL Mariner 2.0 Security Update: etcd (CVE-2021-28235)	Nessus	MarinerOS Local Security Checks	4/25/2023	4/25/2023	critical
177696	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM / 23.04 : etcd vulnerability (USN-6189-1)	Nessus	Ubuntu Local Security Checks	6/28/2023	10/16/2023	critical
196026	RHEL 7 : etcd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
194298	RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:3441)	Nessus	Red Hat Local Security Checks	4/28/2024	4/28/2024	critical
193752	RHEL 8 : Red Hat OpenStack Platform 16.2 (etcd) (RHSA-2023:3445)	Nessus	Red Hat Local Security Checks	4/23/2024	4/23/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical