-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/etcd-io/etcd | go | >= 3.4.0-rc.0, < 3.4.10 | 3.4.10 |
| github.com/etcd-io/etcd | go | < 3.3.23 | 3.3.23 |
Ongoing coverage of React2Shell
GoGoMiggo AIRoot Cause AnalysisThe vulnerability explicitly states that etcd uses os.MkdirAll to create directories with restricted permissions (700), but existing directories are not checked for proper permissions. The Go standard library's os.MkdirAll function is the root cause because it does not enforce permissions on pre-existing directories. While the exact etcd code paths calling os.MkdirAll are not provided in the data, the advisory confirms the improper usage occurs in the etcd package (github.com/etcd-io/etcd/pkg/fileutil) for directory creation. Thus, the vulnerable function is os.MkdirAll as used by etcd in these contexts.