SUSE-SU-2025:0357-1
Vulnerability from csaf_suse - Published: 2025-02-04 14:21 - Updated: 2025-02-04 14:21Summary
Security update for etcd
Notes
Title of the patch
Security update for etcd
Description of the patch
This update for etcd fixes the following issues:
Security
Update to version 3.5.18:
* Ensure all goroutines created by StartEtcd to exit before
closing the errc
* mvcc: restore tombstone index if it's first revision
* Bump go toolchain to 1.22.11
* Avoid deadlock in etcd.Close when stopping during bootstrapping
* etcdutl/etcdutl: use datadir package to build wal/snapdir
* Remove duplicated <-s.ReadyNotify()
* Do not wait for ready notify if the server is stopping
* Fix mixVersion test case: ensure a snapshot to be sent out
* *: support custom content check offline in v2store
* Print warning message for deprecated flags if set
* fix runtime error: comparing uncomparable type
* add tls min/max version to grpc proxy
- Fixing a configuration data loss bug:
Fillup really really wants that the template and the target file
actually follow the sysconfig format. The current config and the
current template do not fulfill this requirement.
Move the current /etc/sysconfig/etcd to /etc/default/etcd and
install a new sysconfig file which only adds the ETCD_OPTIONS
option, which is actually used by the unit file.
This also makes it a bit cleaner to move etcd to use
--config-file in the long run.
- Update etcd configuration file based on
https://github.com/etcd-io/etcd/blob/v3.5.17/etcd.conf.yml.sample
Update to version 3.5.17:
* fix(defrag): close temp file in case of error
* Bump go toolchain to 1.22.9
* fix(defrag): handle defragdb failure
* fix(defrag): handle no space left error
* [3.5] Fix risk of a partial write txn being applied
* [serverWatchStream] terminate recvLoop on sws.close()
Update to version 3.5.16:
* Bump go toolchain to 1.22.7
* Introduce compaction sleep interval flag
* Fix passing default grpc call options in Kubernetes client
* Skip leadership check if the etcd instance is active processing
heartbeats
* Introduce Kubernetes KV interface to etcd client
Update to version 3.5.15:
* Differentiate the warning message for rejected client and peer
* connections
* Suppress noisy basic auth token deletion log
* Support multiple values for allowed client and peer TLS
identities(#18015)
* print error log when validation on conf change failed
Update to version 3.5.14:
* etcdutl: Fix snapshot restore memory alloc issue
* server: Implement WithMmapSize option for backend config
* gRPC health server sets serving status to NOT_SERVING on defrag
* server/mvcc: introduce compactBeforeSetFinishedCompact
failpoint
* Update the compaction log when bootstrap and update compact's
signature
* add experimental-snapshot-catchup-entries flag.
* Fix retry requests when receiving ErrGPRCNotSupportedForLearner
Update to version 3.5.13:
* Fix progress notification for watch that doesn't get any events
* pkg/types: Support Unix sockets in NewURLS
* added arguments to the grpc-proxy: dial-keepalive-time,
dial-keepalive-timeout, permit-without-stream
* server: fix comment to match function name
* Make CGO_ENABLED configurable for etcd 3.5
* etcdserver: drain leaky goroutines before test completed
Patchnames
SUSE-2025-357,openSUSE-SLE-15.6-2025-357
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for etcd",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for etcd fixes the following issues:\n Security\nUpdate to version 3.5.18:\n\n * Ensure all goroutines created by StartEtcd to exit before\n closing the errc\n * mvcc: restore tombstone index if it\u0027s first revision\n * Bump go toolchain to 1.22.11\n * Avoid deadlock in etcd.Close when stopping during bootstrapping\n * etcdutl/etcdutl: use datadir package to build wal/snapdir\n * Remove duplicated \u003c-s.ReadyNotify()\n * Do not wait for ready notify if the server is stopping\n * Fix mixVersion test case: ensure a snapshot to be sent out\n * *: support custom content check offline in v2store\n * Print warning message for deprecated flags if set\n * fix runtime error: comparing uncomparable type\n * add tls min/max version to grpc proxy\n\n- Fixing a configuration data loss bug:\n Fillup really really wants that the template and the target file\n actually follow the sysconfig format. The current config and the\n current template do not fulfill this requirement.\n Move the current /etc/sysconfig/etcd to /etc/default/etcd and\n install a new sysconfig file which only adds the ETCD_OPTIONS\n option, which is actually used by the unit file.\n This also makes it a bit cleaner to move etcd to use\n --config-file in the long run.\n\n- Update etcd configuration file based on\n https://github.com/etcd-io/etcd/blob/v3.5.17/etcd.conf.yml.sample\n\nUpdate to version 3.5.17:\n\n * fix(defrag): close temp file in case of error\n * Bump go toolchain to 1.22.9\n * fix(defrag): handle defragdb failure\n * fix(defrag): handle no space left error\n * [3.5] Fix risk of a partial write txn being applied\n * [serverWatchStream] terminate recvLoop on sws.close()\n\nUpdate to version 3.5.16:\n\n * Bump go toolchain to 1.22.7\n * Introduce compaction sleep interval flag\n * Fix passing default grpc call options in Kubernetes client\n * Skip leadership check if the etcd instance is active processing\n heartbeats\n * Introduce Kubernetes KV interface to etcd client\n\nUpdate to version 3.5.15:\n\n * Differentiate the warning message for rejected client and peer\n * connections\n * Suppress noisy basic auth token deletion log\n * Support multiple values for allowed client and peer TLS\n identities(#18015)\n * print error log when validation on conf change failed\n\nUpdate to version 3.5.14:\n\n * etcdutl: Fix snapshot restore memory alloc issue\n * server: Implement WithMmapSize option for backend config\n * gRPC health server sets serving status to NOT_SERVING on defrag\n * server/mvcc: introduce compactBeforeSetFinishedCompact\n failpoint\n * Update the compaction log when bootstrap and update compact\u0027s\n signature\n * add experimental-snapshot-catchup-entries flag.\n * Fix retry requests when receiving ErrGPRCNotSupportedForLearner\n\nUpdate to version 3.5.13:\n\n * Fix progress notification for watch that doesn\u0027t get any events\n * pkg/types: Support Unix sockets in NewURLS\n * added arguments to the grpc-proxy: dial-keepalive-time,\n dial-keepalive-timeout, permit-without-stream\n * server: fix comment to match function name\n * Make CGO_ENABLED configurable for etcd 3.5\n * etcdserver: drain leaky goroutines before test completed\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-357,openSUSE-SLE-15.6-2025-357",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0357-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0357-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250357-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0357-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020281.html"
},
{
"category": "self",
"summary": "SUSE Bug 1095184",
"url": "https://bugzilla.suse.com/1095184"
},
{
"category": "self",
"summary": "SUSE Bug 1183703",
"url": "https://bugzilla.suse.com/1183703"
}
],
"title": "Security update for etcd",
"tracking": {
"current_release_date": "2025-02-04T14:21:57Z",
"generator": {
"date": "2025-02-04T14:21:57Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0357-1",
"initial_release_date": "2025-02-04T14:21:57Z",
"revision_history": [
{
"date": "2025-02-04T14:21:57Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "etcd-3.5.18-150000.7.9.1.aarch64",
"product": {
"name": "etcd-3.5.18-150000.7.9.1.aarch64",
"product_id": "etcd-3.5.18-150000.7.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "etcdctl-3.5.18-150000.7.9.1.aarch64",
"product": {
"name": "etcdctl-3.5.18-150000.7.9.1.aarch64",
"product_id": "etcdctl-3.5.18-150000.7.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "etcdutl-3.5.18-150000.7.9.1.aarch64",
"product": {
"name": "etcdutl-3.5.18-150000.7.9.1.aarch64",
"product_id": "etcdutl-3.5.18-150000.7.9.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "etcd-3.5.18-150000.7.9.1.ppc64le",
"product": {
"name": "etcd-3.5.18-150000.7.9.1.ppc64le",
"product_id": "etcd-3.5.18-150000.7.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "etcdctl-3.5.18-150000.7.9.1.ppc64le",
"product": {
"name": "etcdctl-3.5.18-150000.7.9.1.ppc64le",
"product_id": "etcdctl-3.5.18-150000.7.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "etcdutl-3.5.18-150000.7.9.1.ppc64le",
"product": {
"name": "etcdutl-3.5.18-150000.7.9.1.ppc64le",
"product_id": "etcdutl-3.5.18-150000.7.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "etcd-3.5.18-150000.7.9.1.s390x",
"product": {
"name": "etcd-3.5.18-150000.7.9.1.s390x",
"product_id": "etcd-3.5.18-150000.7.9.1.s390x"
}
},
{
"category": "product_version",
"name": "etcdctl-3.5.18-150000.7.9.1.s390x",
"product": {
"name": "etcdctl-3.5.18-150000.7.9.1.s390x",
"product_id": "etcdctl-3.5.18-150000.7.9.1.s390x"
}
},
{
"category": "product_version",
"name": "etcdutl-3.5.18-150000.7.9.1.s390x",
"product": {
"name": "etcdutl-3.5.18-150000.7.9.1.s390x",
"product_id": "etcdutl-3.5.18-150000.7.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "etcd-3.5.18-150000.7.9.1.x86_64",
"product": {
"name": "etcd-3.5.18-150000.7.9.1.x86_64",
"product_id": "etcd-3.5.18-150000.7.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "etcdctl-3.5.18-150000.7.9.1.x86_64",
"product": {
"name": "etcdctl-3.5.18-150000.7.9.1.x86_64",
"product_id": "etcdctl-3.5.18-150000.7.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "etcdutl-3.5.18-150000.7.9.1.x86_64",
"product": {
"name": "etcdutl-3.5.18-150000.7.9.1.x86_64",
"product_id": "etcdutl-3.5.18-150000.7.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "etcd-3.5.18-150000.7.9.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcd-3.5.18-150000.7.9.1.aarch64"
},
"product_reference": "etcd-3.5.18-150000.7.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "etcd-3.5.18-150000.7.9.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcd-3.5.18-150000.7.9.1.ppc64le"
},
"product_reference": "etcd-3.5.18-150000.7.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "etcd-3.5.18-150000.7.9.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcd-3.5.18-150000.7.9.1.s390x"
},
"product_reference": "etcd-3.5.18-150000.7.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "etcd-3.5.18-150000.7.9.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcd-3.5.18-150000.7.9.1.x86_64"
},
"product_reference": "etcd-3.5.18-150000.7.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "etcdctl-3.5.18-150000.7.9.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcdctl-3.5.18-150000.7.9.1.aarch64"
},
"product_reference": "etcdctl-3.5.18-150000.7.9.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "etcdctl-3.5.18-150000.7.9.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcdctl-3.5.18-150000.7.9.1.ppc64le"
},
"product_reference": "etcdctl-3.5.18-150000.7.9.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "etcdctl-3.5.18-150000.7.9.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcdctl-3.5.18-150000.7.9.1.s390x"
},
"product_reference": "etcdctl-3.5.18-150000.7.9.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "etcdctl-3.5.18-150000.7.9.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:etcdctl-3.5.18-150000.7.9.1.x86_64"
},
"product_reference": "etcdctl-3.5.18-150000.7.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…