| id: GO-2024-2527 |
| modules: |
| - module: go.etcd.io/etcd |
| versions: |
| - fixed: 0.5.0-alpha.5.0.20221102000833-1f054980bc27 |
| non_go_versions: |
| - introduced: 3.2.22 |
| - fixed: 3.4.22 |
| vulnerable_at: 0.5.0-alpha.5.0.20220915004622-85b640cee793 |
| packages: |
| - package: go.etcd.io/etcd/pkg/tlsutil |
| summary: Insecure ciphers are allowed by default in go.etcd.io/etcd |
| description: |- |
| The TLS ciphers list supported by etcd contains insecure cipher suites. Users |
| may specify that an insecure cipher is used via “--cipher-suites” flag. A |
| list of secure suites is used by default. |
| ghsas: |
| - GHSA-5x4g-q5rc-36jp |
| references: |
| - advisory: https://github.com/etcd-io/etcd/security/advisories/GHSA-5x4g-q5rc-36jp |
| source: |
| id: GHSA-5x4g-q5rc-36jp |
| created: 2024-06-14T11:40:23.789526-04:00 |
| review_status: REVIEWED |
| unexcluded: EFFECTIVELY_PRIVATE |
