| Vulnerability Name: | CVE-2018-16886 (CCN-155498) | ||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2018-09-11 | ||||||||||||||||||||||||||||||||||||||||
| Published: | 2019-01-14 | ||||||||||||||||||||||||||||||||||||||||
| Updated: | 2019-10-24 | ||||||||||||||||||||||||||||||||||||||||
| Summary: | etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway. | ||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) 7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-287 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-16886 Source: BID Type: Third Party Advisory, VDB Entry 106540 Source: REDHAT Type: Third Party Advisory RHSA-2019:0237 Source: REDHAT Type: Third Party Advisory RHSA-2019:1352 Source: CONFIRM Type: Issue Tracking, Patch, Third Party Advisory https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16886 Source: XF Type: UNKNOWN etcd-cve201816886-sec-bypass(155498) Source: MISC Type: Release Notes https://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.2.md#security-authentication Source: MISC Type: Release Notes https://github.com/etcd-io/etcd/blob/1eee465a43720d713bb69f7b7f5e120135fdb1ac/CHANGELOG-3.3.md#security-authentication Source: CCN Type: etcd GIT Repository disable CommonName auth for gRPC-gateway #10366 Source: FEDORA Type: Third Party Advisory FEDORA-2019-219b0b0b6a Source: FEDORA Type: Third Party Advisory FEDORA-2019-833466697f Source: CCN Type: oss-sec Mailing List, Mon, 14 Jan 2019 14:43:58 +1100 CVE-2018-16886 etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway Source: CCN Type: IBM Security Bulletin 6599703 (Db2 On Openshift) Multiple vulnerabilities affect IBM Db2 On Openshift and IBM Db2 and Db2 Warehouse on Cloud Pak for Data Source: CCN Type: IBM Security Bulletin 6991619 (Edge Application Manager) Open Source Dependency Vulnerability Source: CCN Type: WhiteSource Vulnerability Database CVE-2018-16886 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||