CVE-2020-15112
Last modified
CVE-2020-15112 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.. EPSS estimates a 1.26% chance of exploitation in the next 30 days.
Description
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Etcd | Etcd | < 3.3.23 |
| Etcd | Etcd | >= 3.4.0, < 3.4.10 |
| Fedoraproject | Fedora | 32 |
References
- https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93Third Party Advisory
- https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-15112?
How severe is CVE-2020-15112?
How do I fix CVE-2020-15112?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-15107In openenclave before 0.10.0, enclaves that use x87 FPU oper…5.3
- CVE-2020-15108In glpi before 9.5.1, there is a SQL injection for all usage…7.1
- CVE-2020-15109In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there i…5.3
- CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8
- CVE-2020-15110In jupyterhub-kubespawner before 0.12, certain usernames wil…8.1
- CVE-2020-15111In Fiber before version 1.12.6, the filename that is given i…5.4
- CVE-2020-15113In etcd before versions 3.3.23 and 3.4.10, certain directory…7.1
- CVE-2020-15114In etcd before versions 3.3.23 and 3.4.10, the etcd gateway …7.7
- CVE-2020-15115etcd before versions 3.3.23 and 3.4.10 does not perform any …7.5
- CVE-2020-15117In Synergy before version 1.12.0, a Synergy server can be cr…6.5
- CVE-2020-15118In Wagtail before versions 2.7.4 and 2.9.3, when a form page…5.4
- CVE-2020-15119In auth0-lock versions before and including 11.25.1, dangero…5.4
Are you affected by CVE-2020-15112?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST