5.5med
CVE-2018-1099
DNS Rebinding in etcd
Also known as GHSA-wf43-55jj-vwq8
Published 8 y ago · modified 58 d ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 43%
Public exploits
0
none known
Summary
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).
Exploit prediction (EPSS)
0.50% probability of exploitation in the next 30 days, higher than 43% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | go.etcd.io/etcd | <3.4.0 | 3.4.0 |
Affected products
- Red Hat, Inc. etcd
Classification
References
- bugzilla.redhat.com /show_bug.cgi?id=1552717 · x_refsource_CONFIRM, x_transferred
- github.com /coreos/etcd/issues/9353 · x_refsource_CONFIRM, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQR · vendor-advisory, x_refsource_FEDORA, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATR · vendor-advisory, x_refsource_FEDORA, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-1099 · advisory
- github.com /coreos/etcd/commit/a7e5790c82039945639798ae9a3289fe787f5e56 · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQL · web
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVR · web
Sources
- CVE List: CVE-2018-1099
- GitHub Advisory: GHSA-wf43-55jj-vwq8
- NVD: CVE-2018-1099
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.