CVE-2020-15136: Improper Authentication

August 6, 2020 (updated November 18, 2021)

In etcd, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed with improved documentation and deprecation of the functionality.

References

nvd.nist.gov/vuln/detail/CVE-2020-15136

Code Behaviors & Features

Detect and mitigate CVE-2020-15136 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →