CVE-2023-32082: Exposure of Sensitive Information to an Unauthorized Actor

May 12, 2023

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user does not have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

References

github.com/advisories/GHSA-3p4g-rcw5-8298
github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md
github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md
github.com/etcd-io/etcd/pull/15656
github.com/etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298
nvd.nist.gov/vuln/detail/CVE-2023-32082

Code Behaviors & Features

Detect and mitigate CVE-2023-32082 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →