CVE-2018-1099 DNS Rebinding in etcd
MediumCVSS 5.5
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| go.etcd.io/etcd(Go) | < 3.4.0 | 3.4.0 |
| debian/etcd(Debian:12) | < 3.4.23-1 | 3.4.23-1 |
| debian/etcd(Debian:14) | < 3.4.23-1 | 3.4.23-1 |
| debian/etcd(Debian:13) | < 3.4.23-1 | 3.4.23-1 |
| redhat/etcd | <= 3.3.1 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
| ubuntu/etcd(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/etcd(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/etcd(Ubuntu:26.10) | All versions | No fix listed |
| redhat/etcd | = 3.3.1 and earlier | No fix listed |
| ubuntu/etcd(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit third-party-advisory
- github.com patch
- bugzilla.redhat.com issue-tracking patch vendor-advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- github.com
- Debian Security Tracker CVE-2018-1099 vendor-advisory
- bugs.debian.org issue-tracking
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- FEDORA-2019-219b0b0b6a vendor-advisory
- FEDORA-2019-833466697f vendor-advisory