Candidate: CVE-2018-16886
PublicDate: 2019-01-14 19:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16886
 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16886
 https://github.com/etcd-io/etcd/pull/10366
 https://github.com/etcd-io/etcd/commit/bf9d0d8291dc71ecbfb2690612954e1a298154b2
 https://github.com/etcd-io/etcd/commit/a9a9466fb8ba11ad7bb6a44d7446fbd072d59887
 https://github.com/etcd-io/etcd/commit/99704e2a97e8710da942bdc737417fc9c9a2c03f
 https://github.com/etcd-io/etcd/commit/83c051b701d33261eef91a719e4421c81b000ba4
 https://github.com/etcd-io/etcd/pull/10386 (3.2 backport)
Description:
 etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to
 an improper authentication issue when role-based access control (RBAC) is
 used and client-cert-auth is enabled. If an etcd client server TLS
 certificate contains a Common Name (CN) which matches a valid RBAC
 username, a remote attacker may authenticate as that user with any valid
 (trusted) client certificate in a REST API request to the gRPC-gateway.
Ubuntu-Description:
Notes:
 msalvatore> Introduced by https://github.com/etcd-io/etcd/commit/0191509637546621d6f2e18e074e955ab8ef374d
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H [8.1 HIGH]


Patches_etcd:
upstream_etcd: released (3.2.26+dfsg-1)
precise/esm_etcd: DNE
trusty_etcd: DNE
trusty/esm_etcd: DNE
xenial_etcd: not-affected (code not present)
bionic_etcd: needed
cosmic_etcd: ignored (reached end-of-life)
disco_etcd: ignored (reached end-of-life)
eoan_etcd: not-affected (3.2.26+dfsg-3)
focal_etcd: not-affected (3.2.26+dfsg-3)
groovy_etcd: not-affected (3.2.26+dfsg-3)
hirsute_etcd: not-affected (3.2.26+dfsg-3)
impish_etcd: not-affected (3.2.26+dfsg-3)
jammy_etcd: not-affected (3.2.26+dfsg-3)
devel_etcd: not-affected (3.2.26+dfsg-3)