CVE-2020-15136
Fixed in a distro release EPSS 2%CVSS 6.5
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
Products: etcd-io etcd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | go.etcd.io/etcd | 3.4.10 |
| Go | go.etcd.io/etcd | 3.3.23 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | dgraph | 23.1.0-r6 |
| Chainguard | etcd-3.4 | 3.4.36-r1 |
| Chainguard | etcd-3.4-bitnami-compat | 3.4.36-r1 |
| Chainguard | etcd-3.4-iamguarded-compat | 3.4.36-r1 |
| Chainguard | etcd-fips-3.4 | 3.4.36-r1 |
| Debian 12 | etcd | 3.3.25+dfsg-5 |
| Debian 13 | etcd | 3.3.25+dfsg-5 |
| Debian 14 | etcd | 3.3.25+dfsg-5 |
| Red Hat openstack 16.1 | etcd | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debuginfo | 0:3.3.23-1.el8ost |
| Red Hat openstack 16.1 | etcd-debugsource | 0:3.3.23-1.el8ost |
| Ubuntu 16.04 LTS | etcd | no fix |
| Ubuntu 25.10 | etcd | no fix |
| Ubuntu 26.10 | etcd | no fix |
| Ubuntu Pro 18.04 LTS | etcd | no fix |
| Ubuntu Pro 20.04 LTS | etcd | no fix |
| Ubuntu Pro 22.04 LTS | etcd | no fix |
| Ubuntu Pro 24.04 LTS | etcd | no fix |
| Ubuntu Pro 26.04 LTS | etcd | no fix |
| Wolfi | dgraph | 23.1.0-r6 |