CVE-2020-15136: 
etcd vulnerability analysis and mitigation

CVE-2020-15136 affects etcd versions before 3.4.10 and 3.3.23, where gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function, while no authentication is performed against endpoints provided in the --endpoints flag (GitHub Advisory).

The vulnerability was discovered due to unclear documentation of how the gateway handles endpoints validation. The issue stems from the implementation where TLS authentication is limited to endpoints discovered through DNS SRV records, leaving endpoints specified via the --endpoints flag unauthenticated. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N (NVD).

The vulnerability could potentially allow unauthorized access to endpoints specified through the --endpoints flag, as these endpoints bypass the TLS authentication mechanism. This could lead to security implications where authentication is expected but not enforced, potentially compromising the confidentiality and integrity of the affected systems (Red Hat Advisory).

The vulnerability requires network access and high attack complexity to exploit. No authentication is required to attempt exploitation, and no user interaction is needed. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in etcd versions 3.4.10 and 3.3.23 through improved documentation and deprecation of the problematic functionality. Users are advised to upgrade to these patched versions. The fix includes appropriate documentation of the validation functionality and deprecation of the misleading functionality (GitHub Advisory).