Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Find out more about CVE-2018-16886 from the MITRE CVE dictionary dictionary and NIST NVD.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 6.8 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | None |
| Platform | Package | State |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | metrics-server | Not affected |
| Red Hat OpenShift Container Platform 3.11 | cluster-autoscaler | Affected |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Affected |
| Red Hat OpenShift Container Platform 3.10 | etcd | Affected |
| Red Hat Gluster Storage 3 | etcd | Affected |
| Red Hat Enterprise Linux 7 | etcd3 | Not affected |
| Red Hat Enterprise Linux 7 | etcd | Affected |
Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it.
To check the CN field of a certificate:
openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*'
To check if there is a username matching the CN field in the TLS client certificate:
etcdctl user get <TLS client certificate CN>
For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md
For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md
Vulmon