GHSA-2xhq-gv6c-p224

Suggest an improvement
Source
https://github.com/advisories/GHSA-2xhq-gv6c-p224
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-2xhq-gv6c-p224/GHSA-2xhq-gv6c-p224.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2xhq-gv6c-p224
Aliases
Related
Published
2024-01-31T00:21:52Z
Modified
2024-09-11T06:12:23.690966Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
Summary
Etcd Gateway can include itself as an endpoint resulting in resource exhaustion
Details

Vulnerability type

Denial of Service

Detail

The etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

References

Find out more on this vulnerability in the security audit report

For more information

If you have any questions or comments about this advisory: * Contact the etcd security committee

References

Affected packages

Go / go.etcd.io/etcd

Package

Name
go.etcd.io/etcd
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd

Affected ranges

Type
SEMVER
Events
Introduced
3.4.0-rc.0
Fixed
3.4.10

Database specific

{
    "last_known_affected_version_range": "<= 3.4.9"
}

Go / go.etcd.io/etcd

Package

Name
go.etcd.io/etcd
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.23