Vulnerability · Published Aug 5, 2020 · Assigned by GitHub_M
CVE-2020-15113Improper Preservation of Permissions in etcd
Medium 5.7
In plain English
A medium-severity security flaw in etcd from etcd-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | etcd | 3.3.25+dfsg-5 | DEBIAN-CVE-2020-15113 |
| Debian:13 | etcd | 3.3.25+dfsg-5 | DEBIAN-CVE-2020-15113 |
| Debian:14 | etcd | 3.3.25+dfsg-5 | DEBIAN-CVE-2020-15113 |
| Go | github.com/etcd-io/etcd | 3.3.23 | GHSA-chh6-ppwq-jh92 |
| Go | github.com/etcd-io/etcd | 3.4.10 | GHSA-chh6-ppwq-jh92 |
| Ubuntu:25.10 | etcd | no fix listed | UBUNTU-CVE-2020-15113 |
| Ubuntu:26.10 | etcd | no fix listed | UBUNTU-CVE-2020-15113 |
Affected products (as reported)
Weakness: CWE-281 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92 x_refsource_CONFIRM
- FEDORA-2020-cd43b84c16 vendor-advisory, x_refsource_FEDORA