GHSA-wf43-55jj-vwq8
DNS Rebinding in etcd
At a glance
- Published
- Updated
- CVE
- CVE-2018-1099
- CVSS_V3
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Description
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
Affected packages
| Package | Versions |
|---|---|
| Go · go.etcd.io/etcd | introduced 0, fixed 3.4.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1099 ADVISORY
- https://github.com/coreos/etcd/issues/9353 WEB
- https://github.com/coreos/etcd/commit/a7e5790c82039945639798ae9a3289fe787f5e56 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1552717 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |