CVE-2020-15112 Improper Input Validation in etcd
An attacker can cause a runtime panic and crash an etcd consensus participant by providing an invalid entry index during WAL reading.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15112?
CVE-2020-15112 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 5 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
Which versions are affected by CVE-2020-15112?
It affects 2 products.
Products include Etcd Etcd, Fedoraproject Fedora.
How do I fix CVE-2020-15112?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-15112 being exploited?
There is no known exploitation of CVE-2020-15112 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2021-28235 Etcd-io Improper Authentication vulnerability
- CVE-2026-33413 etcd: Authorization bypasses in multiple APIs
- CVE-2022-34038 Denial of service in n/a
- CVE-2018-16886 go.etcd.io/etcd Authentication Bypass
- CVE-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
Sources
Also known as AZL-6389, DEBIAN-CVE-2020-15112, UBUNTU-CVE-2020-15112.