Vulnerability · Published Aug 5, 2020 · Assigned by GitHub_M

CVE-2020-15106Improper Input Validation in etcd

Medium 6.5

In plain English

A medium-severity improper input validation in etcd from etcd-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.3%top 30.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	etcd	3.3.25+dfsg-5	DEBIAN-CVE-2020-15106
Debian:13	etcd	3.3.25+dfsg-5	DEBIAN-CVE-2020-15106
Debian:14	etcd	3.3.25+dfsg-5	DEBIAN-CVE-2020-15106
Go	go.etcd.io/etcd	0.5.0-alpha.5.0.20200423152442-f4b650b51dc4	GHSA-p4g4-wgrh-qrg2
Go	go.etcd.io/etcd	0.5.0-alpha.5.0.20200423152442-f4b650b51dc4	GO-2020-0005
Go	go.etcd.io/etcd/v3	3.3.23	GHSA-m332-53r6-2w93
Go	go.etcd.io/etcd/v3	3.4.10	GHSA-m332-53r6-2w93
Ubuntu:25.10	etcd	no fix listed	UBUNTU-CVE-2020-15106
Ubuntu:26.10	etcd	no fix listed	UBUNTU-CVE-2020-15106

Affected products (as reported)

Vendor	Product	Versions
etcd-io	etcd	< 3.3.23< 3.4.10

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2 x_refsource_CONFIRM
FEDORA-2020-cd43b84c16 vendor-advisory, x_refsource_FEDORA