etcd-3.2.32-1.el7
エラータID: AXSA:2021-1717:01
リリース日:
2021/04/27 Tuesday - 20:55
題名:
etcd-3.2.32-1.el7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- etcd では decodeRecode メソッドに問題があり、WAL ファイルの length フィールドに格納された
レコードのサイズに追加の検証が行われないため、巨大なフレームサイズを偽造することにより、
RAFT 参加者が WAL をデコードしようとした際に意図しないパニックを引き起こす脆弱性があります。
(CVE-2020-15106)
- etcd には、wal/wal.go の ReadAll メソッド内のエントリ数よりも大きなエントリインデックスを持てるため、
etcd の合意している参加者が合意中に WAL のエントリを読み込むと、エントリの読み込み中にランタイムパニックから
ダウンしてしまう脆弱性があります。(CVE-2020-15112)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2020-15106
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
CVE-2020-15112
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
追加情報:
N/A
ダウンロード:
SRPMS
- etcd-3.2.32-1.el7.src.rpm
MD5: 9fdff6cb294d69a8a324dd9d1921da8e
SHA-256: 8af0f57c0f5a6b994acac97ae4ce45d533e1c9a11717bb899467a09d394f1cba
Size: 3.01 MB
Asianux Server 7 for x86_64
- etcd-3.2.32-1.el7.x86_64.rpm
MD5: 023d14eb18ad367527f0f64e59520d12
SHA-256: 0c39c049559313c1f269171a62d0e38918fdaa82029e9cbadcb510b8217bb5c6
Size: 9.50 MB
English