NVD published security issue in Etcd-io v.3.4.10 CVE-2021-28235

[Alexander Bergmann]

Hi etcd folks,

The following CVE was published at NVD yesterday. It's a privilege escalation without any direct details.

https://nvd.nist.gov/vuln/detail/CVE-2021-28235

There are only 2 screenshots attached and I couldn't find any upstream reference. That's the reason I'm posting the question here if you are ware of this problem or not?

Best regards,

Alexander Bergmann

[Benjamin Wang]

Thank you Alexander!

It's a valid CVE, and we already resolved it in https://github.com/etcd-io/etcd/pull/15648.

The fix will be backported to 3.5 and 3.4,  and eventually included in 3.5.8 and 3.4.25.

FYI. The issue can only happen when all the following conditions are true:

1. The auth is enabled;
2. The log level is set to "debug";
3. Clients send authentication request to etcdserver with username & password. Note that client SDK sends authentication request automatically when reading or writing data.

Regards,

Benjamin Wang