| modules: |
| - module: go.etcd.io/etcd |
| versions: |
| - fixed: 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 |
| vulnerable_at: 0.5.0-alpha.5.0.20200422225029-2369cb367873 |
| packages: |
| - package: go.etcd.io/etcd/wal |
| symbols: |
| - WAL.ReadAll |
| - decoder.decodeRecord |
| derived_symbols: |
| - Create |
| - Repair |
| - Verify |
| description: | |
| Malformed WALs can be constructed such that WAL.ReadAll can cause attempted |
| out of bounds reads, or creation of arbitrarily sized slices, which may be used as |
| a DoS vector. |
| published: 2021-04-14T20:04:52Z |
| cves: |
| - CVE-2020-15106 |
| - CVE-2020-15112 |
| ghsas: |
| - GHSA-m332-53r6-2w93 |
| credit: Trail of Bits |
| references: |
| - fix: https://github.com/etcd-io/etcd/pull/11793 |
| - fix: https://github.com/etcd-io/etcd/commit/f4b650b51dc4a53a8700700dc12e1242ac56ba07 |
| - web: https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf |
