Your submission was sent successfully! Close

CVE-2020-15106

Published: 5 August 2020

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
etcd
Launchpad, Ubuntu, Debian
bionic Needed

focal
Released (3.2.26+dfsg-6ubuntu0.1)
groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needed

precise Does not exist

trusty Does not exist

upstream
Released (3.3.23, 3.4.10)
xenial Ignored
(end of standard support, was needed)
Patches:
upstream: https://github.com/etcd-io/etcd/pull/12638/commits/b14255c0b4d1a27221d1857ae0e72bcac7f2b146 (3.3.23)