CVE-2020-15114
Fixed in a distro release EPSS 1%CVSS 7.7
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
Products: etcd-io etcd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | go.etcd.io/etcd | 3.4.10 |
| Go | go.etcd.io/etcd | 3.3.23 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | dgraph | 23.1.0-r6 |
| Chainguard | etcd-3.4 | 3.4.36-r1 |
| Chainguard | etcd-3.4-bitnami-compat | 3.4.36-r1 |
| Chainguard | etcd-3.4-iamguarded-compat | 3.4.36-r1 |
| Chainguard | etcd-fips-3.4 | 3.4.36-r1 |
| Debian 12 | etcd | 3.3.25+dfsg-5 |
| Debian 13 | etcd | 3.3.25+dfsg-5 |
| Debian 14 | etcd | 3.3.25+dfsg-5 |
| Red Hat openstack 16.1 | etcd | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debuginfo | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debugsource | 0:3.3.23-1.el8ost |
| Ubuntu 16.04 LTS | etcd | no fix |
| Ubuntu 20.04 LTS | etcd | 3.2.26+dfsg-6ubuntu0.1 |
| Ubuntu Pro 18.04 LTS | etcd | 3.2.17+dfsg-1ubuntu0.1~esm1 |
| Wolfi | dgraph | 23.1.0-r6 |