ghsa-p4g4-wgrh-qrg2
Vulnerability from github
Published
2023-02-07 22:59
Modified
2023-10-02 13:55
Severity ?
Summary
Panic due to malformed WALs in go.etcd.io/etcd
Details
Vulnerability type
Data Validation
Detail
The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
Specific Go Packages Affected
github.com/etcd-io/etcd/wal
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory: * Contact the etcd security committee
{ "affected": [ { "package": { "ecosystem": "Go", "name": "go.etcd.io/etcd" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.5.0-alpha.5.0.20200423152442-f4b650b51dc4" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2020-15106" ], "database_specific": { "cwe_ids": [ "CWE-20" ], "github_reviewed": true, "github_reviewed_at": "2023-02-07T22:59:30Z", "nvd_published_at": "2020-08-05T19:15:00Z", "severity": "LOW" }, "details": "### Vulnerability type\nData Validation\n\n### Detail\nThe size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.\n\n### Specific Go Packages Affected\ngithub.com/etcd-io/etcd/wal\n\n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)", "id": "GHSA-p4g4-wgrh-qrg2", "modified": "2023-10-02T13:55:51Z", "published": "2023-02-07T22:59:30Z", "references": [ { "type": "WEB", "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15106" }, { "type": "WEB", "url": "https://github.com/etcd-io/etcd/pull/11793" }, { "type": "WEB", "url": "https://github.com/etcd-io/etcd/commit/4571e528f49625d3de3170f219a45c3b3d38c675" }, { "type": "WEB", "url": "https://github.com/etcd-io/etcd/commit/f4b650b51dc4a53a8700700dc12e1242ac56ba07" }, { "type": "PACKAGE", "url": "https://github.com/etcd-io/etcd" }, { "type": "WEB", "url": "https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP" }, { "type": "WEB", "url": "https://pkg.go.dev/vuln/GO-2020-0005" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" } ], "summary": "Panic due to malformed WALs in go.etcd.io/etcd" }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.