CVE-2020-15106
Fixed in a distro release EPSS 1%CVSS 6.5
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
Products: etcd-io etcd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | go.etcd.io/etcd | 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 |
| Go | go.etcd.io/etcd/v3 | 3.3.23 |
| Go | go.etcd.io/etcd/v3 | 3.4.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | dgraph | 23.1.0-r6 |
| Chainguard | etcd-3.4 | 3.4.36-r1 |
| Chainguard | etcd-3.4-iamguarded-compat | 3.4.36-r1 |
| Chainguard | etcd-fips-3.4 | 3.4.36-r1 |
| Chainguard | py3-etcd | 0 |
| Chainguard | py3.10-etcd | 0 |
| Chainguard | py3.11-etcd | 0 |
| Chainguard | py3.12-etcd | 0 |
| Chainguard | py3.13-etcd | 0 |
| Debian 12 | etcd | 3.3.25+dfsg-5 |
| Debian 13 | etcd | 3.3.25+dfsg-5 |
| Debian 14 | etcd | 3.3.25+dfsg-5 |
| Red Hat openstack 16.1 | etcd | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debuginfo | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debugsource | 0:3.3.23-1.el8ost |
| Red Hat rhel extras other 7 | etcd | 0:3.2.32-1.el7_9 |
| Red Hat rhel extras other 7 | etcd-debuginfo | 0:3.2.32-1.el7_9 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | kubernetes | 1.17.13-4.21.2 |
| SUSE Package Hub 15 SP6 | etcd | 3.5.12-bp156.4.3.1 |
| Ubuntu 16.04 LTS | etcd | no fix |
| Ubuntu 20.04 LTS | etcd | 3.2.26+dfsg-6ubuntu0.1 |
| Ubuntu 25.10 | etcd | no fix |
| Ubuntu 26.10 | etcd | no fix |
| Ubuntu Pro 18.04 LTS | etcd | 3.2.17+dfsg-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | etcd | no fix |
| Ubuntu Pro 24.04 LTS | etcd | no fix |
| Ubuntu Pro 26.04 LTS | etcd | no fix |
| Wolfi | dgraph | 23.1.0-r6 |
| Wolfi | py3-etcd | 0 |
| Wolfi | py3.10-etcd | 0 |
| Wolfi | py3.11-etcd | 0 |
| Wolfi | py3.12-etcd | 0 |
| Wolfi | py3.13-etcd | 0 |
| openSUSE Leap 15.5 | etcd | 3.5.12-150000.7.6.1 |
| openSUSE Leap 15.6 | etcd | 3.5.12-bp156.4.3.1 |
| openSUSE Leap 15.6 | etcd | 3.5.12-150000.7.6.1 |
| openSUSE Tumbleweed | etcd | 3.4.16-3.1 |