Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseGHSA-pm3m-32r3-7mfh
GHSA-pm3m-32r3-7mfh:
vulnerability analysis and mitigation
Overview
A data validation vulnerability was discovered in etcd's embed package, specifically in the parseCompactionRetention function within embed/etcd.go. The vulnerability, identified as GHSA-pm3m-32r3-7mfh, affects versions <= 3.4.9 of etcd and was disclosed on August 5, 2020. The issue has been patched in versions 3.4.10 and 3.3.23 (GitHub Advisory).
Technical details
The vulnerability stems from insufficient input validation in the parseCompactionRetention function located in embed/etcd.go. The function allows the retention variable value to be negative, which leads to unexpected behavior in the system's compaction functionality (GitHub Advisory). The severity of this vulnerability has been assessed as Low.
Impact
When exploited, this vulnerability causes the node to execute history compaction in a loop, resulting in excessive CPU usage and log spam. This can potentially affect system performance and storage management capabilities (GitHub Advisory).
Mitigation and workarounds
Users are advised to upgrade to the patched versions: etcd version 3.4.10 or 3.3.23, which address this vulnerability. For those unable to upgrade immediately, it is recommended to ensure that compaction retention values are properly validated before being passed to the system (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management