Headline
Red Hat Security Advisory 2023-3441-01
Red Hat Security Advisory 2023-3441-01 - An update for etcd is now available for Red Hat OpenStack Platform 17.0 (Wallaby).
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat OpenStack Platform 17.0 (etcd) security update
Advisory ID: RHSA-2023:3441-01
Product: Red Hat OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3441
Issue date: 2023-06-05
CVE Names: CVE-2021-28235 CVE-2023-32082
=====================================================================
- Summary:
An update for etcd is now available for Red Hat OpenStack Platform 17.0
(Wallaby).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat OpenStack Platform 17.0 - x86_64
- Description:
A highly-available key value store for shared configuration
Security Fix(es):
Information discosure via debug function (CVE-2021-28235)
Key name can be accessed via LeaseTimeToLive API (CVE-2023-32082)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2184441 - CVE-2021-28235 etcd: Information discosure via debug function
2208131 - CVE-2023-32082 etcd: Key name can be accessed via LeaseTimeToLive API
- Package List:
Red Hat OpenStack Platform 17.0:
Source:
etcd-3.4.26-1.el9ost.src.rpm
x86_64:
etcd-3.4.26-1.el9ost.x86_64.rpm
etcd-debuginfo-3.4.26-1.el9ost.x86_64.rpm
etcd-debugsource-3.4.26-1.el9ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-28235
https://access.redhat.com/security/cve/CVE-2023-32082
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZH54PNzjgjWX9erEAQgJOA/8CUtW9KAsZV6KHhG/WYlA41Dx0LyhV2Pd
FFX9Ir0VxBrVQb+R8Vr/CE9RO/liCK4NHzy1qpUTEUkoqZOTE4I4ClfivE3CaTG/
/f7EgJcm9fTiDTBqCpv6HUtSrFsmxJXehA7U9nIZ45NC0lCD8heZYjBwbmCxuqOQ
oja8mdgz/ScdjCDXLaplUl3Xu7MUbQj371jxkZukuslyBHwam9wg9NfBbvYdspC0
L3mO4u3KZ6YnvHfa31YGjmnEUIWPcimm4iVq7vwBF4o3gA331ezO2NhCHbUFWS97
h7HxlefloGanlWko8JWZUN4NdSDHv5O4N9mLzZ1oqkNa6dFMQ7/cNFUoD6oLm7+8
hYDguNtVV4l9od9B/nb5yeIXMPDk+bhWAQnam7WQ53vf+HWWgvwBjRPX4VB0jfTW
9ja0TgiAsCU6SfPTmf2UHejG6NMst05z9qPKx64DMfNL+pt6h61VQo0X+/qfHQIq
/l9nvz3BeVHZeze2uxvZN+xVnpwURpGBgm4JYB5DqEBBdWORjUqYudAPVnoUKf+K
FcPwhsgy25kajF//iATNqnZcV6GjkbquMaZ9IEOdc4jAXXhl7mz+cSmSHsbzfm8w
hhcx9QUtM/9/2uElky3K1A6y98xSVl2x6tmkE7Ig2DUVGy33HwwsrjWZifdARdED
wrL3WFxoR58=
=hzzC
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Ubuntu Security Notice 6189-1 - It was discovered that etcd leaked credentials when debugging was enabled. This allowed remote attackers to discover etcd authentication credentials and possibly escalate privileges on systems using etcd.
Red Hat Security Advisory 2023-3447-01 - An update for etcd is now available for Red Hat OpenStack Platform 16.1 (Train).
Red Hat Security Advisory 2023-3445-01 - An update for etcd is now available for Red Hat OpenStack Platform 16.2 (Train). Issues addressed include a denial of service vulnerability.
An update for etcd is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-28235: A flaw was found in etcd, where etc-io could allow a remote attacker to gain elevated privileges on the system caused by a vulnerability in the debug function. By sending a specially crafted request, an attacker can gain elevated privileges. * CVE-2023-32082: A flaw was found in etcd. Affected versions of etcd allow a remote, authent...
An update for etcd is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-28235: A flaw was found in etcd, where etc-io could allow a remote attacker to gain elevated privileges on the system caused by a vulnerability in the debug function. By sending a specially crafted request, an attacker can gain elevated privileges. * CVE-2023-32082: A flaw was found in etcd. Affected versions of etcd allow a remote, authent...
An update for etcd is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-28235: A flaw was found in etcd, where etc-io could allow a remote attacker to gain elevated privileges on the system caused by a vulnerability in the debug function. By sending a specially crafted request, an attacker can gain elevated privileges. * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause e...
An update for etcd is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-28235: A flaw was found in etcd, where etc-io could allow a remote attacker to gain elevated privileges on the system caused by a vulnerability in the debug function. By sending a specially crafted request, an attacker can gain elevated privileges. * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause e...
### Impact LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). ### Patches < v3.4.26 and < v3.5.9 are affected. ### Workarounds No. ### Reporter Yoni Rozenshein
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.