UBUNTU-CVE-2020-15106

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2020-15106
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-15106.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-15106
Related
Published
2020-08-05T19:15:00Z
Modified
2020-08-05T19:15:00Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

References

Affected packages

Ubuntu:Pro:16.04:LTS / etcd

Package

Name
etcd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.0+dfsg-2
2.2.1+dfsg-1
2.2.2+dfsg-1
2.2.2+dfsg-2
2.2.3+dfsg-1
2.2.5+dfsg-1
2.2.5+dfsg-1ubuntu1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / etcd

Package

Name
etcd
Purl
pkg:deb/ubuntu/etcd@3.2.17+dfsg-1ubuntu0.1+esm1?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.17+dfsg-1ubuntu0.1+esm1

Affected versions

3.*

3.1.0-1
3.2.9+dfsg-2
3.2.9+dfsg-3
3.2.17+dfsg-1
3.2.17+dfsg-1ubuntu0.1~esm1
3.2.17+dfsg-1ubuntu0.1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "etcd-server-dbgsym": "3.2.17+dfsg-1ubuntu0.1+esm1",
            "golang-etcd-server-dev": "3.2.17+dfsg-1ubuntu0.1+esm1",
            "etcd": "3.2.17+dfsg-1ubuntu0.1+esm1",
            "etcd-client-dbgsym": "3.2.17+dfsg-1ubuntu0.1+esm1",
            "etcd-server": "3.2.17+dfsg-1ubuntu0.1+esm1",
            "etcd-client": "3.2.17+dfsg-1ubuntu0.1+esm1"
        }
    ]
}

Ubuntu:20.04:LTS / etcd

Package

Name
etcd
Purl
pkg:deb/ubuntu/etcd@3.2.26+dfsg-6ubuntu0.1?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.26+dfsg-6ubuntu0.1

Affected versions

3.*

3.2.26+dfsg-3
3.2.26+dfsg-4
3.2.26+dfsg-6

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "etcd-server-dbgsym": "3.2.26+dfsg-6ubuntu0.1",
            "golang-etcd-server-dev": "3.2.26+dfsg-6ubuntu0.1",
            "etcd": "3.2.26+dfsg-6ubuntu0.1",
            "etcd-client-dbgsym": "3.2.26+dfsg-6ubuntu0.1",
            "etcd-server": "3.2.26+dfsg-6ubuntu0.1",
            "etcd-client": "3.2.26+dfsg-6ubuntu0.1"
        }
    ]
}

Ubuntu:22.04:LTS / etcd

Package

Name
etcd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.3.25+dfsg-6
3.3.25+dfsg-7
3.3.25+dfsg-7ubuntu0.22.04.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / etcd

Package

Name
etcd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.4.23-4ubuntu2
3.4.30-1
3.4.30-1build1
3.4.30-1ubuntu0.24.04.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}