CVE-2023-32082 @ Go-go.etcd.io/etcd/server/v3-v3.5.0 #111
Description
Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2023-32082
Applications: yael's application
Checkmarx Project: Yoavast/CX-AST
Repository URL: https://github.com/Yoavast/CX-AST
Branch: main
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
Scan ID: b70b7227-90db-4075-88cb-4c196077be97
The package etcd is a distributed key-value store for the data of a distributed system. In versions prior to 3.4.26, 3.5.x prior to 3.5.9, and 3.6.0-alpha.0 the "LeaseTimeToLive" API allows access to key names (not value) associated with a lease when "Keys" parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster that enables auth (RBAC).
Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: v3.5.9