Miggo Logo
Miggo Vulnerability Database
→
GHSA-j86v-2vjr-fg8f

GHSA-j86v-2vjr-fg8f: Etcd Gateway TLS endpoint validation only confirms TCP reachability

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-j86v-2vjr-fg8f
EPSS Score
-
CWE
-
Published
2/3/2024
Updated
7/8/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
go.etcd.io/etcd/v3go>= 3.4.0-rc.0, <= 3.4.93.4.10
go.etcd.io/etcd/v3go< 3.3.233.3.23

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers around insufficient TLS validation during SRV discovery in etcd gateway. Key functions would be those handling endpoint connectivity checks and SRV discovery initialization. The transport.Endpoint.Dial function is directly responsible for establishing connections and would show TCP dialing activity without TLS in runtime profiles. The v2discovery.SRVGetCluster function initiates the discovery process that triggers these insecure validations. Confidence is high for the dialer function as it's the direct point of insecure connection handling, and medium for the SRV discovery entry point as it's the initiation context.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Vuln*r**ility typ* *rypto*r*p*y ### Work*roun*s R***r to t** [**t*w*y *o*um*nt*tion](*ttps://*it*u*.*om/*t**-io/*t**/*lo*/m*st*r/*o*um*nt*tion/op-*ui**/**t*w*y.m*). T** vuln*r**ility w*s spott** *u* to un*l**r *o*um*nt*tion o* *ow t** **t*w*y **

Reasoning

T** vuln*r**ility **nt*rs *roun* insu**i*i*nt TLS v*li**tion *urin* SRV *is*ov*ry in `*t**` **t*w*y. K*y *un*tions woul* ** t*os* **n*lin* *n*point *onn**tivity ****ks *n* SRV *is*ov*ry initi*liz*tion. T** `tr*nsport.*n*point.*i*l` *un*tion is *ir**t