go.etcd.io/etcd/client/v3 vulnerabilities

Latest go.etcd.io/etcd/client/v3 CVEs

Newest publication first

1. GHSA-9gp7-6833-wv89 etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery

   Published 2022-10-06

   Unknown

   Vulnerability type Data Validation Detail When an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery. References Find out more on this vulnerability in the security audit report For...

2. GHSA-528j-9r78-wffx etcd user credentials are stored in WAL logs in plaintext

   Published 2022-10-06

   Unknown

   Vulnerability type Data Exposure Workarounds The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The etcd doesn't encrypt key/val...

3. CVE-2020-15115 No minimum password length in etcd

   Published 2020-08-06

   High·CVSS 7.5 EPSS 1.3%

   etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.