Vulnerabilities > CVE-2020-15112 - Improper Validation of Array Index vulnerability in multiple products

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

etcd

fedoraproject

CWE-129

NVD

Published: 2020-08-05

Updated: 2023-11-07

Summary

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

Vulnerable Configurations

Part	Description	Count
Application	Etcd Etcd Etcd 3.4.0 Etcd Etcd 3.4.1 Etcd Etcd 3.4.2 Etcd Etcd 3.4.3 Etcd Etcd 3.4.4 Etcd Etcd 3.4.5 Etcd Etcd 3.4.6 Etcd Etcd 3.4.7 Etcd Etcd 3.4.8 Etcd Etcd 3.4.9 Etcd Etcd 0.1.0 Etcd Etcd 0.1.1 Etcd Etcd 0.1.2 Etcd Etcd 0.2.0 Etcd Etcd 0.3.0 Etcd Etcd 0.4.0 Etcd Etcd 0.4.1 Etcd Etcd 0.4.2 Etcd Etcd 0.4.3 Etcd Etcd 0.4.4 Etcd Etcd 0.4.5 Etcd Etcd 0.4.6 Etcd Etcd 0.4.7 Etcd Etcd 0.4.8 Etcd Etcd 0.4.9 Etcd Etcd 0.5.0 Etcd Etcd 2.0.0 Etcd Etcd 2.0.1 Etcd Etcd 2.0.2 Etcd Etcd 2.0.3 Etcd Etcd 2.0.4 Etcd Etcd 2.0.5 Etcd Etcd 2.0.6 Etcd Etcd 2.0.7 Etcd Etcd 2.0.8 Etcd Etcd 2.0.9 Etcd Etcd 2.0.10 Etcd Etcd 2.0.11 Etcd Etcd 2.0.12 Etcd Etcd 2.0.13 Etcd Etcd 2.1.0 Etcd Etcd 2.1.1 Etcd Etcd 2.1.2 Etcd Etcd 2.1.3 Etcd Etcd 2.2.0 Etcd Etcd 2.2.1 Etcd Etcd 2.2.2 Etcd Etcd 2.2.3 Etcd Etcd 2.2.4 Etcd Etcd 2.2.5 Etcd Etcd 2.3.0 Etcd Etcd 2.3.1 Etcd Etcd 2.3.2 Etcd Etcd 2.3.3 Etcd Etcd 2.3.4 Etcd Etcd 2.3.5 Etcd Etcd 2.3.6 Etcd Etcd 2.3.7 Etcd Etcd 2.3.8 Etcd Etcd 3.0.0 Etcd Etcd 3.0.1 Etcd Etcd 3.0.2 Etcd Etcd 3.0.3 Etcd Etcd 3.0.4 Etcd Etcd 3.0.5 Etcd Etcd 3.0.6 Etcd Etcd 3.0.7 Etcd Etcd 3.0.8 Etcd Etcd 3.0.9 Etcd Etcd 3.0.10 Etcd Etcd 3.0.11 Etcd Etcd 3.0.12 Etcd Etcd 3.0.13 Etcd Etcd 3.0.14 Etcd Etcd 3.0.15 Etcd Etcd 3.0.16 Etcd Etcd 3.0.17 Etcd Etcd 3.1.0 Etcd Etcd 3.1.1 Etcd Etcd 3.1.2 Etcd Etcd 3.1.3 Etcd Etcd 3.1.4 Etcd Etcd 3.1.5 Etcd Etcd 3.1.6 Etcd Etcd 3.1.7 Etcd Etcd 3.1.8 Etcd Etcd 3.1.9 Etcd Etcd 3.1.10 Etcd Etcd 3.1.11 Etcd Etcd 3.1.12 Etcd Etcd 3.1.13 Etcd Etcd 3.1.14 Etcd Etcd 3.1.15 Etcd Etcd 3.1.16 Etcd Etcd 3.1.17 Etcd Etcd 3.1.18 Etcd Etcd 3.1.19 Etcd Etcd 3.1.20 Etcd Etcd 3.2.0 Etcd Etcd 3.2.1 Etcd Etcd 3.2.2 Etcd Etcd 3.2.3 Etcd Etcd 3.2.4 Etcd Etcd 3.2.5 Etcd Etcd 3.2.6 Etcd Etcd 3.2.7 Etcd Etcd 3.2.8 Etcd Etcd 3.2.9 Etcd Etcd 3.2.10 Etcd Etcd 3.2.11 Etcd Etcd 3.2.12 Etcd Etcd 3.2.13 Etcd Etcd 3.2.14 Etcd Etcd 3.2.15 Etcd Etcd 3.2.16 Etcd Etcd 3.2.17 Etcd Etcd 3.2.18 Etcd Etcd 3.2.19 Etcd Etcd 3.2.20 Etcd Etcd 3.2.21 Etcd Etcd 3.2.22 Etcd Etcd 3.2.23 Etcd Etcd 3.2.24 Etcd Etcd 3.2.25 Etcd Etcd 3.2.26 Etcd Etcd 3.2.27 Etcd Etcd 3.3.0 Etcd Etcd 3.3.1 Etcd Etcd 3.3.2 Etcd Etcd 3.3.3 Etcd Etcd 3.3.4 Etcd Etcd 3.3.5 Etcd Etcd 3.3.6 Etcd Etcd 3.3.7 Etcd Etcd 3.3.8 Etcd Etcd 3.3.9 Etcd Etcd 3.3.10 Etcd Etcd 3.3.11 Etcd Etcd 3.3.12 Etcd Etcd 3.3.13 Etcd Etcd 3.3.14 Etcd Etcd 3.3.15 Etcd Etcd 3.3.16 Etcd Etcd 3.3.17 Etcd Etcd 3.3.18 Etcd Etcd 3.3.19 Etcd Etcd 3.3.20 Etcd Etcd 3.3.21 Etcd Etcd 3.3.22	189
OS	Fedoraproject Fedoraproject Fedora 32	1

Common Weakness Enumeration (CWE)

CWE-129 - Improper Validation of Array Index

Common Attack Pattern Enumeration and Classification (CAPEC)

Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References