Published: 14/01/2019 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

etcd versions 3.2.x prior to 3.2.26 and 3.3.x prior to 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Vulnerable Product	Search on Vulmon	Subscribe to Product
etcd etcd
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
fedoraproject fedora 30

Debian Bug report logs - #923008 CVE-2018-16886 Package: src:etcd; Maintainer for src:etcd is Debian Go Packaging Team <team+pkg-go@trackerdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 22 Feb 2019 22:33:02 UTC Severity: grave Tags: security, upstream Found in version etcd/3218+dfsg-1 Fi ...

Synopsis Moderate: etcd security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for etcd is now available for Red Hat Enterprise Linux 7 ExtrasRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring S ...

Etcd, versions 320 through 3225 and 330 through 3310, are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled If an etcd client server's TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user wi ...

CWE-287 https://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.3.md#security-authentication https://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.2.md#security-authentication https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16886 http://www.securityfocus.com/bid/106540 https://access.redhat.com/errata/RHSA-2019:0237 https://access.redhat.com/errata/RHSA-2019:1352 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=923008 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2018-16886

CVE-2018-16886

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect