CVE-2020-15115: Weak Password Requirements

October 6, 2022

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users’ passwords with little computational effort.

References

github.com/advisories/GHSA-4993-m7g5-r9hh
github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh
nvd.nist.gov/vuln/detail/CVE-2020-15115

Code Behaviors & Features

Detect and mitigate CVE-2020-15115 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →