CVE-2018-16886

mediumPriorität · verfolgen · 33EPSS 0.041 · 91. PerzentilDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
4.06% (91st) EPSS
CVSS 6.8 · medium
Is it mine?
32 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenetcd-0:3.2.26-1.el7.aarch64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-0:3.2.26-1.el7.ppc64le as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-0:3.2.26-1.el7.s390x as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-0:3.2.26-1.el7.src as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-0:3.2.26-1.el7.x86_64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-debuginfo-0:3.2.26-1.el7.aarch64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-debuginfo-0:3.2.26-1.el7.ppc64le as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-debuginfo-0:3.2.26-1.el7.s390x as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Behobenetcd-debuginfo-0:3.2.26-1.el7.x86_64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2019:1352
  • Workaroundetcd-0:3.2.26-1.el7.aarch64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-0:3.2.26-1.el7.ppc64le as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-0:3.2.26-1.el7.s390x as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-0:3.2.26-1.el7.src as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-0:3.2.26-1.el7.x86_64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-debuginfo-0:3.2.26-1.el7.aarch64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-debuginfo-0:3.2.26-1.el7.ppc64le as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-debuginfo-0:3.2.26-1.el7.s390x as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

  • Workaroundetcd-debuginfo-0:3.2.26-1.el7.x86_64 as a component of Red Hat Enterprise Linux 7 Extrasredhat_csaf

    Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it. To check the CN field of a certificate: openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*' To check if there is a username matching the CN field in the TLS client certificate: etcdctl user get <TLS client certificate CN> For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–8.1

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 6.4
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.2 · Auswirkung 5.9
v3.06.8mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USAusnutzbarkeit 1.6 · Auswirkung 5.2
v3.06.8mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · Red Hat Product Security US
v3.06.8mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU
v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV
v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.1highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-287USprimärCWE-285USCWE-287USCWE-287USCWE-287US
04

betroffene Produkte (32)

Betroffene Produkte und Versionsbereiche.

20 von 32 angezeigt
05

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2019:1352Red Hat Security Advisory: etcd security, bug fix, and enhancement update2019-06-04csaf · redhat_csafUS

    An update for etcd is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2022-0510IBM DB2: Mehrere SchwachstellenDeutsch2022-06-29csaf · cert_bundDE

    Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, willkürlichen Code mit erhöhten Rechten auszuführen, Informationen falsch darzustellen und beliebigen Code auszuführen.

  • GHSA-h6xx-pmxh-3wgpgo.etcd.io/etcd Authentication Bypass2022-04-12ghsa · osvUS

    etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

  • GO-2021-0077Authentication bypass in go.etcd.io/etcd2021-04-14vendor · osvUS

    A user can use a valid client certificate that contains a CommonName that matches a valid RBAC username to authenticate themselves as that user, despite lacking the required credentials. This may allow authentication bypass, but requires a certificate that is issued by a CA trusted by the server.

06

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdredhat_csafNVDCVE.orgMITRE
veröffentlicht 2019-01-14geändert 2026-06-17
09

Referenzen (27)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan