CVE-2020-15113
Fixed in a distro release EPSS <1%CVSS 5.7
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).
Products: etcd-io etcd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/etcd-io/etcd | 3.4.10 |
| Go | github.com/etcd-io/etcd | 3.3.23 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | py3-etcd | 0 |
| Chainguard | py3-supported-etcd | 0 |
| Chainguard | py3.10-etcd | 0 |
| Chainguard | py3.11-etcd | 0 |
| Chainguard | py3.12-etcd | 0 |
| Chainguard | py3.13-etcd | 0 |
| Debian 12 | etcd | 3.3.25+dfsg-5 |
| Debian 13 | etcd | 3.3.25+dfsg-5 |
| Debian 14 | etcd | 3.3.25+dfsg-5 |
| Red Hat openstack 16.1 | etcd | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debuginfo | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debugsource | 0:3.3.23-1.el8ost |
| Ubuntu 16.04 LTS | etcd | no fix |
| Ubuntu 20.04 LTS | etcd | 3.2.26+dfsg-6ubuntu0.1 |
| Ubuntu 25.10 | etcd | no fix |
| Ubuntu 26.10 | etcd | no fix |
| Ubuntu Pro 18.04 LTS | etcd | 3.2.17+dfsg-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | etcd | no fix |
| Ubuntu Pro 24.04 LTS | etcd | no fix |
| Ubuntu Pro 26.04 LTS | etcd | no fix |
| Wolfi | py3-etcd | 0 |
| Wolfi | py3-supported-etcd | 0 |
| Wolfi | py3.10-etcd | 0 |
| Wolfi | py3.11-etcd | 0 |
| Wolfi | py3.12-etcd | 0 |
| Wolfi | py3.13-etcd | 0 |