Vulnerability · Published Aug 5, 2020 · Assigned by GitHub_M
CVE-2020-15112Improper Input Validation in etcd
Medium 6.5
In plain English
A medium-severity improper input validation in etcd from etcd-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | etcd | 3.3.25+dfsg-5 | DEBIAN-CVE-2020-15112 |
| Debian:13 | etcd | 3.3.25+dfsg-5 | DEBIAN-CVE-2020-15112 |
| Debian:14 | etcd | 3.3.25+dfsg-5 | DEBIAN-CVE-2020-15112 |
| Go | go.etcd.io/etcd | 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 | GHSA-p4g4-wgrh-qrg2 |
| Go | go.etcd.io/etcd | 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 | GO-2020-0005 |
| Go | go.etcd.io/etcd/v3 | 3.3.23 | GHSA-m332-53r6-2w93 |
| Go | go.etcd.io/etcd/v3 | 3.4.10 | GHSA-m332-53r6-2w93 |
| Ubuntu:25.10 | etcd | no fix listed | UBUNTU-CVE-2020-15112 |
| Ubuntu:26.10 | etcd | no fix listed | UBUNTU-CVE-2020-15112 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93 x_refsource_CONFIRM
- FEDORA-2020-cd43b84c16 vendor-advisory, x_refsource_FEDORA