etcd: CVE-2018-1098 CVE-2018-1099

Debian Bug report logs - #921156
etcd: CVE-2018-1098 CVE-2018-1099

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: etcd: CVE-2018-1098 CVE-2018-1099

Date: Sat, 02 Feb 2019 13:50:39 +0100

Source: etcd
Version: 3.2.18+dfsg-1
Severity: grave
Tags: security upstream
Forwarded: https://github.com/coreos/etcd/issues/9353

Hi,

The following vulnerabilities were published for etcd. Not sure
exactly on the severity but prefer to be rather safe than sorry
afterwards.

CVE-2018-1098[0]:
| A cross-site request forgery flaw was found in etcd 3.3.1 and earlier.
| An attacker can set up a website that tries to send a POST request to
| the etcd server and modify a key. Adding a key is done with PUT so it
| is theoretically safe (can't PUT from an HTML form or such) but POST
| allows creating in-order keys that an attacker can send.

CVE-2018-1099[1]:
| DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An
| attacker can control his DNS records to direct to localhost, and trick
| the browser into sending requests to localhost (or any other address).

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-1098
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1098
[1] https://security-tracker.debian.org/tracker/CVE-2018-1099
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1099
[2] https://github.com/coreos/etcd/issues/9353

Regards,
Salvatore

Message #12 received at 921156@bugs.debian.org (full text, mbox, reply):

From: Arnaud Rebillout <arnaud.rebillout@collabora.com>

To: 921156@bugs.debian.org

Cc: foka@debian.org

Subject: Re: etcd: CVE-2018-1098 CVE-2018-1099

Date: Tue, 12 Feb 2019 09:32:48 +0700

I looked into this a bit yesterday.

As mentioned in the issue upstream at
https://github.com/etcd-io/etcd/issues/9353, the fix has been merged in
the master branch of etcd in March 2018, almost a year ago. The
conversation also mentions that this will be part of the next release
v3.4. However v3.4 has not been released yet.

And I don't think we want to package a random commit from the master
branch of etcd. So if we want to solve this bug simply by updating the
package, we'll have to wait for v3.4 to be released.

The other alternative is to cherry-pick the patch.

If I'm not mistaken, the fix can be found in this MR:
https://github.com/etcd-io/etcd/pull/9372/files. It's not a trivial
patch. It's unlikely that we can apply it without modification on the
etcd currently packaged in debian.

I personally can't do that, as I know nothing about etcd anyway. I don't
know if someone feels up to the task, or have a better idea about how to
solve that.

Cheers,

  Arnaud

Message #17 received at 921156@bugs.debian.org (full text, mbox, reply):

From: Stephen Gelman <ssgelm@debian.org>

To: 921156@bugs.debian.org

Subject: Re: etcd: CVE-2018-1098 CVE-2018-1099

Date: Tue, 19 Feb 2019 23:24:47 -0600

On Tue, 12 Feb 2019 09:32:48 +0700 Arnaud Rebillout
<arnaud.rebillout@collabora.com> wrote:
> I looked into this a bit yesterday.
>
> As mentioned in the issue upstream at
> https://github.com/etcd-io/etcd/issues/9353, the fix has been merged in
> the master branch of etcd in March 2018, almost a year ago. The
> conversation also mentions that this will be part of the next release
> v3.4. However v3.4 has not been released yet.
>
> And I don't think we want to package a random commit from the master
> branch of etcd. So if we want to solve this bug simply by updating the
> package, we'll have to wait for v3.4 to be released.
>
> The other alternative is to cherry-pick the patch.
>
> If I'm not mistaken, the fix can be found in this MR:
> https://github.com/etcd-io/etcd/pull/9372/files. It's not a trivial
> patch. It's unlikely that we can apply it without modification on the
> etcd currently packaged in debian.
>
> I personally can't do that, as I know nothing about etcd anyway. I don't
> know if someone feels up to the task, or have a better idea about how to
> solve that.
>
> Cheers,
>
>   Arnaud

Since upstream still hasn't released a version that fixes the CVE is
this still considered a RC bug?  Obviously it's better to fix it asap
but if upstream doesn't consider it critical I'm not sure this should
be RC.

Stephen

Message #22 received at 921156@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Stephen Gelman <ssgelm@debian.org>

Cc: 921156@bugs.debian.org, control@bugs.debian.org

Subject: Re: etcd: CVE-2018-1098 CVE-2018-1099

Date: Fri, 22 Feb 2019 23:27:13 +0100

severity 921156 important
thanks

On Tue, Feb 19, 2019 at 11:24:47PM -0600, Stephen Gelman wrote:
> On Tue, 12 Feb 2019 09:32:48 +0700 Arnaud Rebillout
> <arnaud.rebillout@collabora.com> wrote:
> > I looked into this a bit yesterday.
> >
> > As mentioned in the issue upstream at
> > https://github.com/etcd-io/etcd/issues/9353, the fix has been merged in
> > the master branch of etcd in March 2018, almost a year ago. The
> > conversation also mentions that this will be part of the next release
> > v3.4. However v3.4 has not been released yet.
> >
> > And I don't think we want to package a random commit from the master
> > branch of etcd. So if we want to solve this bug simply by updating the
> > package, we'll have to wait for v3.4 to be released.
> >
> > The other alternative is to cherry-pick the patch.
> >
> > If I'm not mistaken, the fix can be found in this MR:
> > https://github.com/etcd-io/etcd/pull/9372/files. It's not a trivial
> > patch. It's unlikely that we can apply it without modification on the
> > etcd currently packaged in debian.
> >
> > I personally can't do that, as I know nothing about etcd anyway. I don't
> > know if someone feels up to the task, or have a better idea about how to
> > solve that.
> >
> > Cheers,
> >
> >   Arnaud
> 
> Since upstream still hasn't released a version that fixes the CVE is
> this still considered a RC bug?  Obviously it's better to fix it asap
> but if upstream doesn't consider it critical I'm not sure this should
> be RC.

Let's downgrade and revisit when a fix has been backported to a 3.2.x
release.

Cheers,
        Moritz

Send a report that this bug log contains spam.