GO-2021-0077
Authentication bypass in go.etcd.io/etcd
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2018-16886
- Alias
- GHSA-h6xx-pmxh-3wgp
Description
A user can use a valid client certificate that contains a CommonName that matches a valid RBAC username to authenticate themselves as that user, despite lacking the required credentials. This may allow authentication bypass, but requires a certificate that is issued by a CA trusted by the server.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · go.etcd.io/etcd | introduced 0, fixed 0.5.0-alpha.5.0.20190108173120-83c051b701d3 |
Références
- https://github.com/etcd-io/etcd/pull/10366 FIX
- https://github.com/etcd-io/etcd/commit/bf9d0d8291dc71ecbfb2690612954e1a298154b2 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |