Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2020-15106: etcd Crashes When Decoding Malformed WAL Records
CVE-2020-15106 · published 6 years ago
Summary
A security flaw in older versions of etcd can cause the system to crash if it receives a specially crafted record from another etcd node. This can happen when two etcd nodes are communicating with each other. To fix this, upgrade etcd to version 3.3.23 or later, or version 3.4.10 or later.
What to do
- Update go.etcd.io etcd to version 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4.
- Update canonical etcd to version 3.2.17+dfsg-1ubuntu0.1~esm1.
- Update canonical etcd to version 3.2.26+dfsg-6ubuntu0.1.
- Update debian etcd to version 3.3.25+dfsg-5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | go.etcd.io | etcd |
< 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 Fix: upgrade to 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4
|
| – | etcd | etcd |
< 3.3.23 >= 3.4.0, < 3.4.10 cpe:2.3:a:etcd:etcd:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
32 cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | etcd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | etcd |
< 3.2.17+dfsg-1ubuntu0.1~esm1 Fix: upgrade to 3.2.17+dfsg-1ubuntu0.1~esm1
|
| Ubuntu:20.04:LTS | canonical | etcd |
< 3.2.26+dfsg-6ubuntu0.1 Fix: upgrade to 3.2.26+dfsg-6ubuntu0.1
|
| Ubuntu:Pro:22.04:LTS | canonical | etcd | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | etcd | All versions |
| Ubuntu:25.10 | canonical | etcd | All versions |
| Debian:12 | debian | etcd |
< 3.3.25+dfsg-5 Fix: upgrade to 3.3.25+dfsg-5
|
Original advisory text
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done o...
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-15106
- https://github.com/etcd-io/etcd/pull/11793
- https://github.com/etcd-io/etcd/commit/4571e528f49625d3de3170f219a45c3b3d38c675
- https://github.com/etcd-io/etcd/commit/f4b650b51dc4a53a8700700dc12e1242ac56ba07
- https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://pkg.go.dev/vuln/GO-2020-0005
- https://github.com/advisories/GHSA-p4g4-wgrh-qrg2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2 Third Party Advisory
- https://ubuntu.com/security/CVE-2020-15106 Third Party Advisory
- https://ubuntu.com/security/notices/USN-5628-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-5628-2 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-15106 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2020-15106 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published5 Aug 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-p4g4-wgrh-qrg2 · GHSA
CVE-2020-15106 · NVD
UBUNTU-CVE-2020-15106 · OSV
DEBIAN-CVE-2020-15106 · OSV
Track software like this
Free during beta