Go/go.etcd.io/etcd/client/v3: low
etcd user credentials are stored in WAL logs in plaintext
Action: Upgrade go.etcd.io/etcd/client/v3 to 3.3.23 or later.
go get go.etcd.io/etcd/client/v3@v3.4.10go get go.etcd.io/etcd/client/v3@v3.3.23Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.4.0 | 3.4.10 | - |
| 0 | 3.3.23 | - |
Fixed versions
| 3.4.10 | 3.3.23 |
Sources
- osv: GHSA-528j-9r78-wffx
- https://github.com/etcd-io/etcd/security/advisories/GHSA-528j-9r78-wffx
- https://github.com/etcd-io/etcd/issues/10132
- https://github.com/etcd-io/etcd/pull/11818
- https://github.com/etcd-io/etcd/commit/585814082b8c8b7db272b30b365b81d27df4a4cb
- https://github.com/etcd-io/etcd
- https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md#does-etcd-encrypt-data-stored-on-disk-drives
- https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf
published · modified · JSON